Aviation Safety: Proposals to Enhance Aircraft Tracking and Flight Data Recovery May Aid Accident Investigation, but Challenges Remain
Published: 2015-04-16T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The AF447 and MH370 disasters have raised questions about why authorities have been unable to locate passenger aircraft. In response to these aviation accidents, government accident investigators, international organizations, and industry have offered proposals that aim to enhance oceanic flight tracking and flight data recovery on a global scale. Given the implications for the U.S. commercial fleet, it is essential that the Congress understand the strengths and weaknesses of these proposals.
GAO was asked to review efforts to enhance aircraft tracking and flight data recovery. This report describes (1) the challenges in tracking aircraft and recovering flight data highlighted by recent commercial aviation accidents over oceanic regions; (2) government and industry proposals to enhance aircraft tracking, and how aviation stakeholders view their strengths and weaknesses; and (3) government and industry proposals to enhance the recovery of flight data, and how aviation stakeholders view the proposals' strengths and weaknesses. GAO reviewed reports by government accident investigators and others, and technology presentations by avionics manufacturers, including current cost data, which was not available in all cases. GAO also interviewed 21 aviation stakeholders, including FAA, the National Transportation Safety Board, and industry, selected based on their expertise in aviation technology and flight operations. FAA and NTSB provided technical comments on a draft of this report, which were incorporated as appropriate.
section_title: What GAO Found
paragraphs: The crash of Air France Flight 447 (AF447) off the coast of Brazil in June 2009 and the disappearance of Malaysia Airlines Flight 370 (MH370) in the southern Indian Ocean in March 2014 highlight several challenges authorities may face in locating aircraft in distress and recovering flight recorders. First, oceanic surveillance is limited, and an aircraft's position may not be precisely known. For example, MH370 continued to fly for several hours outside of radar coverage after onboard communications equipment were no longer working, according to investigators. Additionally, communication and coordination between air traffic control centers in oceanic regions pose challenges. Finally, these accidents show that investigators may have difficulty locating and recovering flight recorders, which are used to determine accident causes, because of the ocean's depth and terrain. For instance, locating AF447's flight recorders took 2 years at a cost of approximately $40 million.
Proposals to enhance aircraft tracking: Following the disappearance of MH370, the international aviation community developed voluntary performance standards to establish a near-term aircraft tracking capability using existing technologies and a long-term comprehensive aircraft tracking concept of operations.
Near-term voluntary aircraft tracking performance standards : An industry task force called for automatic position reporting to airlines every 15 minutes and faster reporting when triggers, such as an unusual change in altitude, are met. According to stakeholders, existing technologies can meet this standard, and many domestic long-haul aircraft are equipped to do so, although some additional ground infrastructure may be needed. However, some airlines may face costs to equip aircraft with these technologies. In the longer term, technologies like satellite-based surveillance may provide global aircraft tracking.
Long-term global aeronautical distress system : The International Civil Aviation Organization has proposed a long-term framework, which is designed to ensure an up-to-date record of aircraft progress and, in the case of emergency, the location of survivors, the aircraft, and its flight recorders. Stakeholders noted that the new framework begins to address the need for improved coordination and information sharing. One component is a tamper-proof distress tracking system, which is not yet available.
Proposals to enhance flight data recovery: Low-cost actions are planned to increase the battery life of the underwater locator beacon—which emits a “ping” to help locate the flight recorders—from 30 to 90 days. In the longer term, two proposals seek to enable flight data recovery without underwater retrieval; however, neither would eliminate investigators' need to recover the wreckage itself or eliminate all search and recovery costs.
Automatic deployable recorders : Designed to separate automatically before a crash and float, deployable recorders may be easier to recover. However, stakeholders are divided on equipping the commercial fleet. Some raised concerns that safety testing is needed and that equipage costs are high and potentially unnecessary given the rarity of oceanic accidents.
Triggered transmission of flight data : Transmitting data automatically from the aircraft during emergencies would allow for some post-flight analysis when the flight recorders cannot be easily recovered. However, some stakeholders raised feasibility and data protection concerns.

section_title: Letter
paragraphs: Although air travel is safe, aviation accidents may result in loss of life and  undermine public confidence in the aviation system. The crash of Air  France Flight 447 (AF447) in June 2009 and the disappearance of  Malaysia Airlines Flight 370 (MH370) in March 2014 have raised  questions about how—in a world of modern, interconnected  technologies—authorities have been unable to locate state-of-the-art  passenger aircraft. For example, more than a year after disappearing en  route to Beijing, investigators have found no trace of MH370, amid a  search and recovery effort that has involved 26 nations and is projected  to be the most expensive in aviation history. In oceanic regions,  authorities have also faced challenges retrieving planes’ flight data and  cockpit voice recorders, which play an important role in helping  investigators determine the causes of and circumstances surrounding  aviation accidents. In the case of AF447, the effort to locate and retrieve  the plane’s recorders more than 12,000 feet below the ocean’s surface  lasted almost 2 years after the plane crashed. In response to these  aviation accidents, governments, international organizations, and industry  have proposed new strategies and technologies that aim in different ways  to address the challenges of locating commercial aircraft and recovering  flight recorders in oceanic areas.
Given the implications for the U.S. commercial fleet and Congress’s role  in enhancing and overseeing aviation safety, you asked us to review  efforts to enhance aircraft tracking and flight data recovery. Specifically,  this report describes (1) the challenges in flight tracking and flight data  recovery that are highlighted by recent commercial aviation accidents  over oceanic regions, (2) government and industry proposals to enhance  aircraft tracking, and how aviation stakeholders view the strengths and  weaknesses of these proposals, and (3) government and industry  proposals to enhance the recovery of flight data, and how aviation  stakeholders view the strengths and weaknesses of these proposals.
To identify the challenges in tracking commercial flights and recovering  flight recorders highlighted by recent commercial aviation accidents, we  reviewed government reports on the investigations of the AF447 and  MH370 accidents and interviewed officials from the Federal Aviation  Administration (FAA), National Transportation Safety Board (NTSB), and  the International Civil Aviation Organization (ICAO) to obtain their  perspectives on recent aviation accidents. To determine the various  government and industry proposals to enhance aircraft tracking and flight  data recovery, we reviewed recommendations and reports from  government investigative agencies, working papers and reports from  industry meetings held by international organizations, technology  presentations from avionics manufacturers, and industry white papers.We requested information from vendors and airlines regarding costs of  various technology proposals. However, cost data were not available in  some cases, and in other cases we were unable to obtain specific costs  due to concerns about the sensitivity of proprietary information.  Therefore, we provide broad estimates of potential costs where possible  and discuss the types of costs that may be incurred, such as installation,  data transmission, and maintenance costs. To describe the views of  aviation stakeholders regarding the strengths and weaknesses of the  government and industry proposals, we interviewed 21 stakeholders,  including FAA and NTSB officials and representatives from two  international organizations, faculty from one academic institution, two  airframe manufacturers, three domestic airlines, four avionics  manufacturers, two air transport communications service providers, three  industry trade associations, and two satellite services companies. We  identified and selected these stakeholders to include facets of the aviation  industry that would potentially be affected by any new international  standards or domestic regulatory changes that may be considered to  enhance global flight tracking and flight data recovery. We also selected  stakeholders based on their expertise with respect to aviation safety,  technology, and flight operations. Their views should not be used to make  generalizations about the views of all industry stakeholders, but do  provide a range of perspectives on issues affecting the industry. See  appendix I for a listing of the aviation stakeholders we interviewed.
We conducted this performance audit from May 2014 through April 2015  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: On a typical day, approximately 100,000 flights around the world reach  their destinations without incident, and the safety of the global air  transportation system has continued to improve in recent years. The  United States air transport system, in particular, is experiencing one of  the safest periods in its history. The FAA, an agency of the Department of  Transportation, is primarily responsible for the advancement, safety, and  regulation of civil aviation, as well as overseeing the development of the  air traffic control (ATC) system. The FAA’s stated mission is to provide  the safest, most efficient aerospace system in the world. Air traffic  control on a global level is coordinated by ICAO, which establishes global  standards for air navigation, air traffic control, aircraft operations,  personnel licensing, airport design, and other issues related to air safety.
FAA collaborates with ICAO in setting standards and procedures for  aircraft, personnel, airways, and aviation services domestically and  throughout the world.
Air navigation service providers (ANSPs) are organizations authorized to  provide air navigation services. For example, FAA’s Air Traffic  Organization is responsible for providing safe and efficient air navigation  services in U.S. airspace. Air traffic services units provide air traffic  control, flight information, and alerting services in portions of airspace  called flight information regions. According to Annex 11 to the Convention  on International Civil Aviation, air traffic control is provided to prevent  collisions and expedite and maintain an orderly flow of air traffic, among  other things. Surveillance plays an important role in air traffic control as  the ability to accurately and reliably determine the location of aircraft has  a direct influence on how efficiently a given airspace may be utilized.  Additionally, according to ICAO, surveillance can be used as the basis for  automated alert systems, as the ability to actively track aircraft enables air  traffic control to be alerted, for example, when an aircraft deviates from its  altitude or route. Radar is a surveillance technology that provides the air  traffic controller with an on-screen view of aircraft position. Air traffic  control uses radar to determine the position of aircraft and the aircraft’s  reported altitude at a given time when traveling over land or coastlines.  An aircraft’s transponder automatically transmits a reply when it receives  an interrogation radio signal from ground radar stations. During the cruise  portion of a flight within radar coverage, the aircraft’s position is reported  at least every 12 seconds, depending on the rotational speed of the  ground radar antenna. FAA and its aviation counterparts in other parts of  the world—including Europe, Asia, and Australia—are in the process of  transitioning from radar-based surveillance to a system using Automatic  Dependent Surveillance-Broadcast (ADS-B), which once implemented, is  expected to provide air traffic controllers and pilots with more accurate  information to help keep aircraft safely separated in the sky and on  runways.
In areas without radar or ADS-B coverage—including oceanic airspace,  remote geographic regions such as the North and South Poles, and some  areas in Africa, Asia, and South America—pilots use radio communications systems to report the position of their aircraft to air traffic  control. According to FAA guidance for oceanic and international  operations, aircraft are to report their position to the ANSP responsible for  the airspace where the aircraft is operated and should do so before  passing from one flight information region to another. On routes that are  not defined by designated reporting points, aircraft should report as  soon as possible after the first 30 minutes of flight and at hourly intervals  thereafter, with a maximum interval between reports of 1 hour and 20  minutes. On oceanic routes, aircraft should report their position at all  designated reporting points, as applicable; otherwise, flights should report  their position at designated lines of latitude and longitude. Aircraft flying in  oceanic airspace may be equipped with additional avionics and satellite  communications capabilities, such as the Future Air Navigation System  (FANS), which creates a virtual radar environment to allow air traffic  control to safely place more aircraft in the same airspace.
ICAO requires that, at a minimum, aircraft operating over oceans must have a  functioning two-way radio to communicate with the appropriate air traffic control unit. FAA  requires Part 121 operators (i.e., scheduled commercial air carriers) to carry certain  communication and navigation equipment for extended over-water operations. For  example, aircraft of these operators must have at least two independent long-range  navigation systems and at least two independent long-range communication systems to  communicate with at least one appropriate station from any point on the route. software, which is integrated with an aircraft’s flight management system,  provides a means for digital transmission of short messages between the  aircraft and ATC using radio or satellite communication systems. To fly at  optimum altitudes in the North Atlantic—the busiest oceanic airspace in  the world—operators were required to equip with FANS by February 5,  2015. Aircraft equipped with FANS can transmit Automatic Dependent  Surveillance-Contract (ADS-C) reports, which may include information on  the plane’s current position and intended path to air traffic control.  Position reports sent through ADS-C transmit at defined time intervals,  when specific events occur such as a sudden loss of altitude, or based on  a request from air traffic control.
In addition to the role of surveillance in air traffic control, FAA requires  commercial airlines conducting scheduled and nonscheduled operations  under part 121 of federal aviation regulations to have a flight following  system in place to ensure the proper monitoring of the progress of each  flight from origin to destination, including intermediate stops and  diversions. Major airlines monitor the progress of flights from their  operational centers using technologies such as the Aircraft  Communications Addressing and Reporting System (ACARS), a  communications system used predominantly for transmission of short text  messages from the aircraft to airline operational centers via radio or  satellite communication.
When an aircraft is in distress, or does not communicate as expected, air  traffic control’s responsibility for providing alerting services is provided in  Annex 11 to the Convention on International Civil Aviation. There are 3  phases intended to notify search and rescue services to take appropriate  measures, including:
Uncertainty phase: Established when communication has not been  received from the crew within the 30-minute period after a  communication should have been received.
Alert phase: Established when subsequent attempts to contact the  crew or inquiries to other relevant sources have failed to reveal any  information about the aircraft.
Distress phase: Established when more widespread inquiries have  failed to provide any information, and when the fuel on board is  considered to be exhausted.
ICAO members establish search and rescue regions to provide  communication infrastructure, distress alert routing, and operational  coordination for supporting search and rescue services.and rescue regions, aeronautical rescue coordination centers are  responsible for the search and rescue operations prompted by an aviation  accident. ICAO encourages countries, where practicable, to combine their  search and rescue resources into a joint rescue coordination center with  responsibility for both aeronautical and maritime search and rescue.
Search and rescue authorities may be alerted to distress situations by  satellite constellations operated by the International Cospas-Sarsat  Program that detect transmissions from an aircraft’s emergency locator  transmitter. The emergency locator transmitter may be automatically  activated by the shock typically encountered during an emergency or  manually by a member of the flight crew. Satellites detect an activated  transmitter and send the signals to ground stations, which determine the  transmitter’s position and report to search and rescue authorities.  Individual countries are responsible for providing these services.
In the rare event of a disaster, after any survivors have been rescued,  physical recovery of the aircraft’s wreckage and the flight data recorder  (FDR) and cockpit voice recorder (CVR)—commonly referred to as the  black boxes—from the crash site is a priority in order to determine the  cause of and circumstances surrounding the accident. After recovering  the recorders, each about 20 pounds and roughly the size of a shoebox,  investigators from civil accident investigation authorities—such as the  NTSB in the United States or the French Bureau d’Enquêtes et  d’Analyses (BEA)—download and analyze data on flight conditions and  the cockpit’s audio environment. Other potential sources of information  that can help determine the cause and circumstances of an aviation  accident include any communications between the flight crew and air  traffic control, radar track history, data transmitted from various systems  onboard the aircraft, aircraft wreckage, and the crash site.
ICAO standards for flight recorders, established in Annex 6 to the  Convention on International Civil Aviation, are based on aircraft weight  and provide that flight data recorders and cockpit voice recorders should  retain the information recorded during at least the last 25 hours and 30  minutes of operation, respectively. FAA establishes the domestic regulations, policies, and guidance for the certification and airworthiness  of flight recorders, as it does for other equipment and instruments on part  121 aircraft. In general, turbine powered commercial aircraft operating  under part 121 must have a flight data recorder and a cockpit voice  recorder, both of which undergo extensive testing to minimize the  probability of damage resulting from a crash. See figure 1 for more  detailed information on the FDR and CVR components.
section_title: Recent Air Disasters Highlight Challenges Related to Surveillance in Oceanic Airspace, ATC Communication, and Underwater Searches
subsections: section_title: Aircraft Can Be Difficult to Locate in Oceanic Airspace because of Surveillance Limitations and the Potential for Aircraft Communications Systems to Be Disabled
paragraphs: Surveillance limitations in oceanic airspace and disabled aircraft  communications systems may make it more difficult to determine the  precise location of an aircraft in distress or an accident site. Over land,  radar monitors aircraft position in real time but coverage diminishes more  than 150 miles from coastlines or in remote airspace such as the polar  regions. In non-radar environments, flight crews rely on procedural  surveillance by periodically reporting their position to air traffic control  when passing certain waypoints on their flight plan. Intervals between  position reports vary, but aircraft in oceanic and remote airspace should  report their position at least every 80 minutes, according to FAA guidance  for oceanic operations. According to one avionics manufacturer, it may  take a flight crew 10 to 20 minutes to report their position using high  frequency (HF) radio due to the disruptions caused by weather and  atmospheric conditions over the oceans. Given that an aircraft cruises at  speeds of more than 500 miles per hour (depending on altitude), an  aircraft could travel more than 167 miles between 20-minute position  reports, in comparison to radar’s ability to determine an aircraft’s location  at least every 12 seconds. An aircraft reporting every 80 minutes could  travel more than 600 miles between position reports. In airspace with less  air traffic, such as remote oceanic regions, air traffic control does not  require continuous contact with aircraft to maintain safe separation. Even  more frequent position reports may not provide precise information on the  aircraft’s location. For example, during its scheduled flight to Paris on  June 1, 2009, AF447’s last regular ACARS position report was sent at  02:10 Coordinated Universal Time (UTC)maintenance messages were transmitted between 02:10 and 02:15, the  approximate time of the plane’s crash. Based on the time the last ACARS  message was received, investigators established a search area of more  than 17,000 square kilometers, more than 500 nautical miles from any  coastline, with a radius of 40 nautical miles centered on the plane’s last  known location. MH370’s communications systems also included ACARS,  but as discussed below, this system and other onboard systems stopped  transmitting data during flight.
Additionally, air traffic control and airline operation centers may be unable  to determine an aircraft’s location if communications equipment onboard  the plane is damaged, malfunctioning, or has been manually turned off.  For example, MH370 departed from Kuala Lumpur at 16:42 UTC on  March 8, 2014 on a scheduled flight to Beijing, China. According to the  Australian Transport Safety Bureau, the agency leading the search for the  plane, MH370’s flight path includes three distinct sections:  1.  an initial stage after takeoff in which the aircraft was under secondary  radar, the transponder was operational, and ACARS messages were  being transmitted;  2.  a second stage in which onboard communications equipment were no  longer working and the plane was only being tracked by military radar;  and  3.  a final stage in which the only available information on the flight’s path  comes from satellite communications log data.
At 17:07, the aircraft transmitted its final automatic ACARS message,  which included the weight of the fuel remaining on board. The flight  crew’s last radio contact with Malaysian air traffic control occurred at  17:19 and then MH370 lost contact with air traffic control during a  transition between Malaysian and Vietnamese airspace at 17:22. At  18:22, Malaysian military radar tracked MH370 flying northwest along the  Strait of Malacca; this was the final radar data indicating the airplane’s  position. After disappearing from military radar, MH370’s satellite  communications system exchanged seven signaling messages—also  referred to as “handshakes”—with the ground station, a satellite over  the Indian Ocean, and the aircraft’s satellite communications from 18:25  until 00:19. According to the Australian Transport Safety Bureau, the  final signaling message, a log-on request from the aircraft, indicates a  power interruption on board that may have been caused by an exhausted  fuel supply. At 01:15, MH370 did not respond to the signaling message  from the ground station. Using the handshake data to determine that it  continued to fly for several hours after disappearing from radar and  estimates of the aircraft’s range based on the fuel quantity included in the  final ACARS message, investigators placed MH370’s final location  somewhere in Australia’s search and rescue region on an arc in the  southern Indian Ocean. The current phase of the search is focused on an  area of approximately 60,000 square kilometers.
section_title: Communication and Coordination among ATC, Operators, and Search and Rescue Authorities in Oceanic Areas Can Be Challenging
paragraphs: Communication and coordination between air traffic control centers can  be difficult in oceanic and remote areas. As discussed previously,  responsibility for global air traffic control is divided geographically by flight  information region. Over the course of an oceanic flight, an aircraft may  transition frequently between flight information regions in areas in which  the ability to communicate with air traffic control can be limited. With  respect to AF447, the TASIL waypoint in the Atlantic Ocean is located on  the boundary between the Brazilian and Senegalese flight information  regions. According to the final report on the investigation of the AF447  accident, controllers from the Atlantico Area Control Center in Brazil— which had been in contact with the aircraft—and the adjacent Dakar  Oceanic Area Control Center in Senegal—which never established  contact with the aircraft—stated that the quality of the HF radio reception  was poor the night of the accident, resulting in recurring communication  problems. The report found that there were powerful cloud clusters on the  route of AF447, which may have created notable turbulence. The  Atlantico controller last had contact at 01:35, when the crew read off their  altitude and flight plan. Over the next minute, the controller asked the  crew three times for its estimated time to cross the TASIL waypoint but  received no response. The flight, however, did not encounter serious  problems until 02:10 and the accident occurred in the Atlantico region at  approximately 02:14. The crew should have established contact with  Dakar air traffic controllers at approximately 02:20 when the aircraft was  due to pass the TASIL waypoint. Dakar controllers stated that they were  not concerned about the absence of radio contact with AF447 given the  HF problems that night and since aircraft frequently crossed all or some  of the Dakar flight information region without making radio contact. The  AF447 final report concluded that the radio communication problems and  meteorological conditions resulted in the controllers considering the  situation (i.e., no contact with the flight) as normal. Furthermore, there  were several communications breakdowns at critical junctures.  Specifically, the report noted the lack of contact between the Atlantico  controller and the flight crew before the transfer to the Dakar controller  and the lack of contact between the Atlantico and Dakar controllers after  AF447’s projected passage of the TASIL waypoint, both of which  indicated that air traffic control had not effectively monitored the aircraft.  The report also noted that a timely alert was not triggered because the  controller in each region failed to communicate with the other as each  individual controller anticipated. See figure 2 for a timeline of the AF447  accident.
Furthermore, according to the AF447 final report, information inquiries  regarding the aircraft were not coordinated, resulting in air traffic control,  search and rescue, and the operators questioning each other without  making a decision about what action to take. Although the last contact  with AF447 occurred at approximately 01:35, it took more than 9 hours for  search teams to take off from Senegal and Brazil. The first search plane  arrived at the TASIL waypoint approximately 13 hours after the crash.  Contrary to ICAO standards and recommended practices, Brazil and  Senegal did not have a search and rescue protocol. Consequently, the  Brazilian and Senegalese rescue coordination centers were not aware of  each country’s available resources, and the report stated that it was not  possible to quickly identify one aeronautical rescue coordination center to  lead the search and rescue mission. In the absence of a protocol, the  report noted that the rescue coordination centers wasted considerable  time gathering information and determining whether to trigger a search.  The report also noted that there was a lack of coordination within the  French aeronautical rescue coordination center and with its foreign  counterparts in organizing the search and rescue. After being informed by  Air France about a series of failure messages issued by the aircraft to its  maintenance center in France, authorities from the French aeronautical  rescue coordination center considered themselves not competent to  intervene in a zone outside their area of responsibility. The report noted  that this belief could be explained by ineffective training for search and  rescue agents, particularly in terms of coordination with foreign  counterparts. The French aeronautical rescue coordination center also  provided key information to organizations that were not, according to the  final report, competent in search and rescue; for example, one of the  organizations failed to forward the last known position of the aircraft from  an ACARS message.
MH370 also highlights the complexities of coordinating search and rescue  activities in areas with multiple flight information regions when the final  location of the plane is unknown. As noted earlier, MH370 departed from  Kuala Lumpur at 16:42 UTC on March 8, 2014. At 17:19, Kuala Lumpur  air traffic control instructed MH370 to contact Ho Chi Minh air traffic  control, and the flight crew acknowledged this request over the radio.  According to the interim report issued by the Malaysia Ministry of  Transport’s Safety Investigation Team for MH370, another contact should  have occurred at about 17:22 when MH370 passed the IGARI waypoint,  but MH370 lost contact with ATC during the transition between Malaysian  and Vietnamese airspace. The Ho Chi Minh City air traffic control center  contacted the Kuala Lumpur air traffic control center at 17:39 to inquire   Thereafter, according to the report,  about the whereabouts of MH370.Kuala Lumpur initiated efforts involving the Malaysia Airlines operations  center and Singapore, Hong Kong, and Phnom Penh air traffic control  centers to establish MH370’s location, a process that lasted nearly 4  hours. The Kuala Lumpur aeronautical rescue coordination center  transmitted the first distress message related to MH370 at 22:32—more  than 5 hours after the last message expected from the crew—to begin  search and rescue operations in the South China Sea based on the  aircraft’s last known position. According to the report, Malaysian search  and rescue aircraft took off heading to the search areas at 03:30.
section_title: Underwater Searches for Flight Recorders Are Difficult
paragraphs: After an aviation accident, investigators have typically been able to  recover the flight recorders in a matter of days or weeks. We reviewed  data on the 16 commercial plane crashes over water that occurred  globally since 2000. Additional information on each of the 16 accidents is  found in appendix III. In two instances—AF447 and MH370—search and  recovery efforts for the recorders exceeded 1 year. In these cases,  recovery of the flight recorders was hampered because investigators did  not know the precise location of the crash site. The search for AF 447  involved a 17,000 square kilometer area, and the ongoing search for the  wreckage of MH370 is focused on 60,000 square kilometers in the  southern Indian Ocean. Additionally, the complexities of the underwater  environment may hamper efforts to retrieve recorders. While authorities  located some debris from AF447 in a remote section of the Atlantic  Ocean within a few days of the accident on June 1, 2009, they were  unable to locate the recorders during that time. The first phase of the  BEA’s search for the recorders focused on the underwater locator  beacons. Batteries in the current beacons are designed to allow the  signal to be transmitted for at least 30 days and its range is typically  limited to less than 3 nautical miles depending on water’s depth,  underwater topography, and surrounding conditions. If the location of the  crash cannot be determined within 30 days, the time available to search  for the recorders while the beacons’ batteries have life is limited. The  search for AF447’s beacons using a towed pinger locator followed the  airplane’s projected trajectory in the Atlantic but was unable to detect an  acoustic signal within the minimum 30-day transmission period. From July  2009 to April 2011, the BEA attempted to locate the wreckage and  recorders in several search phases using sonar detection, evaluation of  aircraft debris drift, and satellite-tracked buoys, each time unsuccessfully.  After identifying the wreckage site at a depth of more than 12,000 feet,  investigators ultimately found the flight recorders in May 2011 amid  aircraft debris scattered on the seafloor. The BEA subsequently  determined that the cockpit voice recorder’s beacon was damaged on  impact while the beacon on the flight data recorder separated and was  never found. As a result of these challenges, the search for the plane’s  flight recorders took 2 years and cost an estimated $40 million.
section_title: Near-Term Proposals Do Not Fully Address Flight Tracking Challenges, but Long- Term Solutions Are under Development
paragraphs: In response to MH370, the international aviation community has  undertaken a number of efforts to improve global aircraft tracking. In the  near term, a task force formed by the International Air Transport  Association (IATA) developed a set of voluntary performance standards  that call for position reporting every 15 minutes with the capability to  increase the reporting rate in case of emergency. Several technologies  that are already on board most domestic aircraft can be used to meet this  standard, although airlines would face some costs to equip if they do not  already have those systems or satellite communications equipment. Over  the longer term, ICAO has proposed a comprehensive new aircraft  tracking framework designed to ensure that accurate information about  the aircraft’s location is known at all times. In addition to incorporating the  industry recommendations on aircraft tracking, the new concept also  proposes an autonomous distress tracking system, an alternative to  underwater flight data retrieval, and new procedures to improve  coordination and information sharing during emergencies.
subsections: section_title: Most Long-Haul Aircraft Are Equipped with Technologies That Can Transmit Location Information, but More Frequent Position Reporting Can Add Costs to Airlines, and Some Challenges Remain
paragraphs: In the aftermath of the MH370 tragedy, the international aviation  community has undertaken a number of efforts to improve global aircraft  tracking capabilities. For example, just weeks after the disappearance of  MH370, ICAO convened a special meeting to study issues related to  aircraft tracking, and international stakeholders agreed to accelerate the  timeframes for a new aircraft tracking approach, according to the U.S.  ambassador to ICAO. In addition, IATA, which represents the  international aviation industry, formed an Aircraft Tracking Task Force  (Task Force) that focused on what airlines could do to support aircraft in  the near term using existing technologies. The Task Force developed a  set of voluntary performance standards to establish a baseline aircraft   The  tracking capability for all commercial passenger aircraft worldwide.key aircraft tracking performance standards proposed by the Task Force  include:
Position reporting every 15 minutes, with capability to increase the  reporting rate in response to an emergency. This performance  standard calls for regular and automatic transmission of aircraft  position information. The 15-minute frequency reflects the optimal  balance between the benefit of knowing flight location with greater  precision and the costs of transmitting data, as well as the cost of  search and rescue operations, according to the Oceanic Position  Tracking Improvement and Monitoring Initiative. The Task Force  also called for any aircraft tracking system to have the capability to  report more frequently when certain circumstances are met, such as  unusual change in the trajectory, vertical speed, or altitude of the  aircraft. The purpose of the increased position reporting rate is to  narrow the search zone for an aircraft in distress.
Position reports should include latitude, longitude, altitude, and time  information. This performance standard calls for position reporting in  four dimensions. Latitude and longitude provide the aircraft’s location  on a map, while altitude and time provide other data points to pinpoint  the precise position of the aircraft at any stage of the flight.
Communications protocols between the airline and air traffic service  provider to facilitate coordination in case of an emergency situation.  The Task Force recognized that there is a need both to amend  existing procedures and to develop new or improved communications  protocols between airlines and air traffic service providers. The  purpose of this performance standard is to establish communication  procedures and protocols to better respond to instances of missing  position reports or other unexplainable developments.
In order to achieve this baseline aircraft tracking standard, the Task Force  recommended that aircraft operators evaluate their capabilities,  implement measures to meet the performance standards within 12  months, and exchange best practices. According to the Task Force, these  standards and recommendations are designed to improve the collective  ability of the airline industry to identify and track aircraft globally. The  Task Force also recognized that near-term procedures are just first steps  in a longer-term, integrated concept of operations for aircraft tracking  during all phases of flight. This concept of operations is discussed further  below.
Several technologies could be used to meet the recommended aircraft  tracking performance standards, according to the Task Force and aviation  stakeholders we interviewed. For instance, ACARS- and FANS-equipped  aircraft can be configured to report aircraft position information, even  though ACARS is not specifically designed for that function and FANS is  designed to report to air traffic control, not to airlines. According to the  Task Force, ACARS uses information derived from the aircraft’s flight  management system to report the aircraft’s position, and ACARS is  configurable for enhanced reporting triggered by unanticipated altitude  changes or flight levels below a predetermined altitude. For aircraft that  are equipped with FANS, the airline ground systems can be configured to  access information about the position of the aircraft, using Automatic  Dependent Surveillance-Contract (ADS-C)—an application that allows the  airline or air traffic control to establish a contract with the FANS system  onboard the aircraft to deliver four dimensional position and other data at  single, periodic, or event-based intervals. In addition, other benefits of  FANS include reduced separation between aircraft, more direct routings  leading to reduced fuel consumption, and improved communication clarity  between the pilot and air traffic control. Other commercially available  systems, including FLYHT Aerospace Solution’s Automated Flight  Information Reporting System, would also meet the proposed  performance standards by providing operators with precise information  about the aircraft’s position in real-time, according to the manufacturer.Passenger Wi-Fi systems, which utilize satellite connectivity, could also  be used to facilitate aircraft tracking, according to representatives from  one domestic airline.
The level of equipage for these various technologies differs across the  U.S. and global fleet. According to one of the major air transport  communications service providers, almost all commercial passenger jet  aircraft operators in the U.S. install and use ACARS, including nearly all  regional airlines. Three major domestic passenger airlines that we spoke to also confirmed that their entire fleets are equipped with ACARS.  Generally, airlines based outside the U.S. use ACARS, except some low- cost airlines that have avoided the cost of installing ACARS avionics and  use only very high-frequency (VHF) voice radio or other solutions,  according to one air transport communications service provider.
According to some aviation stakeholders we spoke to—including FAA,  two domestic airlines, and one of the major air transport communications  service providers—fewer airlines have equipped with FANS because it is  only beneficial to the airlines when flying in certain, higher density oceanic  airspace. FAA officials we spoke to estimated that approximately 70—80  percent of the aircraft operating in the busy North Atlantic airspace are  currently FANS-equipped because it is required to access the optimal  routes. According to one air transport communications service provider,  FANS equipage on short-haul aircraft is very low, but is expected to  increase because aircraft will need FANS avionics to be able to  communicate with certain components of FAA’s Next Generation Air  Transportation System (NextGen) in the future. Airlines that wish to take  advantage of the optimal flight paths between North America and Europe  will need to be FANS-equipped by 2015; therefore, FANS equipage is  expected to increase in the future, according to FAA. Representatives  from one large domestic airline said they are installing FANS on all of  their aircraft used for international operations largely because of its  operational and safety benefits. Another airline that we spoke to is also  planning to equip its aircraft that operate from the U.S. West Coast to  Hawaii because of the operational efficiencies expected by using FANS.  Finally, two major airframe manufacturers told us that all new aircraft  typically come equipped with the latest communications, navigation, and  surveillance avionics, including ACARS and FANS, but the operator  chooses to enable the system depending on where the aircraft is used.
Despite their benefits, the technologies that could be used to achieve the  Task Force’s baseline aircraft tracking standard in the near term do not  address all the challenges associated with locating flights. For example,  according to one major airframe manufacturer, neither ACARS nor FANS  is tamper-proof, which means that a knowledgeable individual could  disable both systems and the aircraft’s transponder. Should those  systems and the transponder be turned off, the aircraft would be  incapable of sending position data. Aviation stakeholders told us that  there are legitimate engineering and operating reasons for the flight crew  to have total control over all on-board systems. According to one major  airframe manufacturer, aircraft are designed with the assumption that the  pilot and flight crew are trusted and should have complete control over  the aircraft. In certain situations, air traffic control may ask a pilot to turn  the transponder off and back on to identify an aircraft. Other stakeholders  we spoke to said that the pilot’s ability to turn off any system on board the  aircraft is based first and foremost on safety considerations.  Nevertheless, at least two major international airlines have called for a  tamper-proof aircraft tracking solution.
Should they choose to adopt the technologies described above, airlines  that currently do not meet the Task Force aircraft tracking performance  standards would face some costs. Estimates of those costs across the  fleet are difficult to determine with any precision because data on the  level of aircraft equipage were not consistently available and the contracts  between the airlines, avionics manufacturers, and air transport  communications service providers to provide such services are  proprietary. Costs to equip with ACARS using VHF radio could be up to  $100,000 per aircraft. Additionally, ACARS using satellite  communications would cost another $60,000 to $150,000 per aircraft for  Iridium or Inmarsat equipment, according to one air transport  communications service provider. However, according to the airframe  manufacturers we spoke with, most long-haul aircraft that fly in oceanic  and remote regions are already equipped with those units. For aircraft  without FANS, there would be an additional cost of up to $250,000 for a  new FANS-capable flight management system, according to one air  transport communications service provider. Costs for FLYHT Aerospace  Solution’s Automated Flight Information Reporting System, a commercial  system that could, among other things, provide aircraft position data,  were approximately $70,000 per system, including installation labor per  aircraft but not the cost of data transmission, according to company  representatives.
In order to more frequently report position information using ACARS or  FANS, airlines may have to pay for increased data transmission, but we  were unable to determine the extent of these costs to industry. According  to one air transport communications service provider, ACARS data  transmission costs per month can range from $500 per short-haul aircraft  using VHF radio systems, to approximately $1,000 per aircraft for long- haul aircraft using satellite communications over oceans. According to  one domestic airline, airlines pay for ACARS messages through plans  similar to cellular text messaging, and therefore, it is not clear whether  more frequent position reports would be covered under existing plans, or  would require new plans at a higher cost.
To help mitigate these costs and enhance tracking capabilities in the near  term, aviation stakeholders have offered a number of proposals to  enhance flight tracking. One proposal offered by the satellite  communications provider Inmarsat would provide four free position  reports per hour using FANS ADS-C capability. To take advantage of this  proposal, aircraft would need to be equipped with FANS and Inmarsat  satellite communications. A separate proposal from SITA, a major  provider of ACARS data, aims to provide ADS-C reports to airlines.  According to SITA, the company’s proposal may help improve  coordination between the airline and the air navigation service provider,  especially if there is an unexpected event onboard the aircraft. Rockwell  Collins, the other major providers of ACARS data, unveiled a flight  tracking service in March 2015 that utilizes several data sources,  including ADS-B, ADS-C, and ACARS. Over the longer term, other  aircraft surveillance systems may become available that build on FAA’s  transition to NextGen. Aireon, a joint venture between four air navigation  service providers—Nav Canada, ENAV (Italy) and the Irish Aviation  Authority, and Naviair (Denmark)—as well as the satellite service provider  Iridium, aims to use ADS-B technology on satellites to provide a global  aircraft surveillance system. According to Aireon representatives, its  space-based ADS-B system is scheduled to be fully deployed in 2017,  although the system would not be operational until after a test and  validation phase is completed, which is currently planned for early 2018.  The real-time surveillance costs provided by this system are being  discussed with individual air navigation service providers at this time.  Aviation stakeholders we spoke to recognize the potential of this spaced- based surveillance system in terms of enhancing aircraft tracking in  oceanic and remote regions. Aireon has also announced a free service to  be offered using the space-based ADS-B system—Aircraft Locating and  Emergency Response Tracking (ALERT)—that would provide the last  known or current location of any aircraft equipped with ADS-B technology  to search and rescue teams in emergency situations.
section_title: ICAO’s Long-Term Framework for Aircraft Tracking during All Flight Phases Proposes Tamper- Proof Autonomous Distress Tracking, but Poses Several Implementation Challenges
paragraphs: In parallel with the Aircraft Tracking Task Force, an ICAO-led Ad-Hoc  Working Group on Flight Tracking developed a long-term framework— called the Global Aeronautical Distress and Safety System (GADSS)—to  ensure that accurate information about the aircraft’s location is known  during the sequence of events before and after an accident. Both industry  and ICAO worked to harmonize their proposals, according to  stakeholders involved in the process, and at ICAO’s High-Level Safety  Conference in February 2015, delegates from over 120 nations endorsed  the GADSS framework for aircraft tracking. This framework is designed to  maintain an up-to-date record of aircraft progress and, in the case of a  forced landing, the location of survivors, the aircraft, and the flight  recorders.Force recommendations on tracking aircraft, but goes further, as  described below.
The GADSS consists of four key system components:
Aircraft tracking system: This tracking system incorporates the Task  Force’s near-term recommendations to enhance aircraft tracking, as  described above, and specifies that when an abnormal event is  detected, the position reporting rate of the aircraft tracking system  increases to around a 1-minute interval, an increase that translates to  knowing the aircraft’s position within 6 nautical miles; such reporting  can be achieved with the systems discussed previously.
Autonomous distress tracking system: The GADSS framework goes  further than the Task Force standards by calling for an autonomous  distress tracking system. According to the Ad-Hoc Working Group, an  autonomous distress tracking system operates independently from the  regular aircraft tracking system and may be automatically or manually  activated at any time. This system could be automatically triggered by  unusual attitude, speed or acceleration, failure of the regular aircraft  tracking system or surveillance avionics, or a complete loss of engine  power. aircraft power or other systems, and be tamper-proof.
In addition, the system would operate independently of
Automatic deployable flight recorder: The GADSS proposal currently  calls for an automatically deployed flight recorder. This device is  designed to automatically separate from the aircraft in the event of an  accident. At the February 2015 High-Level Safety Conference, ICAO  proposed the use of deployable recorders or an alternative for data  retrieval. Additional information about deployable flight recorders is  provided later in this report.
Procedures and information management: The final component of the  GADSS aircraft tracking framework recognizes that the effectiveness  of any search and rescue service is only as good as the weakest link  in the chain of people, procedures, systems, and information.  Therefore, in addition to the technology, the GADSS identifies key  areas of improvement, such as existing procedures, improved  coordination and information sharing, and enhanced training of  personnel in reacting to emergency circumstances.
According to ICAO, the performance specifications for the in-flight triggering criteria and  broadcasting rate to be used are still under development.
System Wide Information Management consists of standards, infrastructure, and  governance enabling air traffic management information and its exchange between  qualified parties via interoperable services, according to ICAO. assessment of the shortcomings in coordination and information sharing  between air navigation service providers and search and rescue  authorities is needed. Moreover, the GADSS also calls for the  development of guidance material and training on emergency situations  for air navigation service providers. These efforts outlined in the GADSS  are essential; however, the steps to strengthen the people, procedures,  systems and information sharing must be carried out by individual  countries.
section_title: Improvements to Flight Data Recovery Are Starting with Extended Beacons, While Other Proposals May Impose Significant Costs, according to Stakeholders
paragraphs: In response to recent aviation accidents, government, international  organizations, and industry have been developing proposals to enhance  flight recorder recovery in oceanic regions. In the near term,  manufacturers are scheduled to begin adding extended batteries on the  underwater locator beacons (ULBs) attached to flight recorders and have  the option to add a second low-frequency device. Longer-term proposals  to equip commercial aircraft with automatic deployable flight recorders  and the capability to stream up to all FDR data are in various stages of  development. Some have also called for enhanced cockpit recorders to  aid accident investigation by recording additional audio and adding  images. While each technology or proposal is intended to improve data  recovery and accident investigations, industry has raised various  concerns for the commercial fleet regarding the need for such changes  and the costs associated with them.
subsections: section_title: Actions Under Way to Extend Battery Life and Introduce Low Frequency Devices Are Intended to Enhance Flight Recorder Recovery in the Near Term
paragraphs: To help address challenges in locating flight recorders and aircraft  wreckage in oceanic areas, FAA and other international aviation  authorities have taken actions recommended by the French BEA  investigating the AF447 accident to enhance ULBs. Additionally, the  NTSB has also recently issued a related recommendation. First, to help  address the challenges posed by the limited time that search and rescue  authorities have to detect the ULB signal, the BEA recommended  extending the ULB battery life from 30 to 90 days. In February 2012, the  FAA issued a Technical Standard Order (TSO) for a 90-day battery ULB  effective March 1, 2015, at which point the previous TSO for a 30-day  battery would be revoked. The FAA issued a TSO authorization to one  manufacturer in December 2014 and to another in February 2015.  However, on March 10, 2015, the FAA delayed the effective date of the  TSO until December 1, 2015, to provide a major aircraft manufacturer  additional time for testing and analysis of the device’s installation.  Underwater locator beacons manufactured on or after the December 1,  2015, effective date must meet the new requirements. The FAA is not  requiring U.S. airlines to retrofit aircraft with a 90-day battery immediately.  Instead, airlines are expected to replace 30-day ULB batteries through  attrition on their normal replacement schedule of approximately every 6  years so as not to introduce additional costs associated with taking  aircraft out of service outside of regular schedules. We estimate that all  U.S. domestic aircraft should have a 90-day battery ULB installed by the  end of 2021. Related international standards will become effective by  2018.
Second, to help search and rescue authorities locate the aircraft  wreckage underwater, the BEA recommended adding a mandatory  second underwater locating device with a greater transmission range.  The FAA issued a TSO, effective June 26, 2012, that allows  manufacturers to add a second optional device directly attached to the  airframe. This second device would emit a low-frequency acoustic signal  with a range of approximately 5 miles, which is about four times the range  of the ULBs attached to the flight recorders. This additional device is  optional for airlines and manufacturers. In January 2015, NTSB issued a  recommendation for a low-frequency device attached to the airframe that  will function for at least 90 days and that can be detected by equipment  available on military search and rescue, and salvage assets commonly  used to search for and recover wreckage.
Stakeholders we spoke with, including airframe manufacturers, a trade  association, and an avionics manufacturer, generally agreed that  extending the ULB battery life made sense and could improve flight data  recovery for oceanic accidents at a low cost to the airlines; however,  there was no consensus on the need for a second underwater locating  device. One airframe manufacturer told us that it was taking steps to  prepare for attaching a low-frequency device to the airframe, whereas  another told us that this might not be necessary if an aircraft tracking  solution could meet the same performance of providing an aircraft’s last  known location within 6 nautical miles. However, ocean currents can  move aircraft wreckage from its initial point of impact, and therefore, it is  unclear whether a tracking solution would provide the same function as a  second device.
While both the 90-day battery ULB and the low-frequency underwater  locating device are intended to help locate the flight recorders and aircraft  wreckage in oceanic regions and potentially mitigate some costs with an  underwater sonar search, they do not address all the potential challenges  of flight recorder retrieval in remote oceanic regions. For example,  investigators must still know the general location of impact. Otherwise,  the search area would be too large, hampering the location and retrieval  of the flight data for the accident investigation despite these longer-life  and longer-range devices. The flight tracking proposals discussed  previously address this concern to a certain extent. In addition,  underwater conditions—including depth, topography, and surrounding  conditions—can still affect ULB performance. Range can also be reduced  if the device is covered or blocked by aircraft wreckage. Finally, locating  the signal is only one step. Even if investigators detect the signal,  retrieving the recorders may be difficult if located deep underwater or in  difficult terrain.
section_title: ICAO and NTSB Have Proposed Flight Data Recovery without Underwater Retrieval, Though Some Stakeholders Identified Concerns for the Commercial Fleet
paragraphs: In addition to enhancing the ULBs to help locate the recorders  underwater, governments, international organizations, and industry have  been looking at additional changes to improve flight data recovery in  oceanic regions, one prescribing a specific technology and another using  a performance-based approach. ICAO included automatic deployable  flight recorders in its long-term GADSS framework. NTSB issued a safety  recommendation calling for a means of recovering flight data without  underwater retrieval, which would allow for either a deployable recorder  or triggered transmission of mandatory flight data during emergencies.  While these technologies are designed to improve flight data recovery,  some aviation stakeholders had concerns with installing either of these  technologies on the commercial fleet.
subsections: section_title: Automatic Deployable Flight Recorders
paragraphs: As discussed above, ICAO’s longer-term GADSS framework calls for  automatic deployable flight recorders in order to provide faster and easier  recovery of flight recorder data, especially in oceanic regions. Deployable  recorders, which have been used for decades on U.S. military aircraft,  including military versions of commercial aircraft, and helicopters,  combine an FDR/CVR with an emergency locator transmitter in one  crash-survivable unit. The deployable recorder is designed to separate  automatically from an external section of the tail or leading edge of the  aircraft when sensors detect an imminent crash. After separation, the  deployable recorder is designed to avoid the crash impact zone and,  when over oceanic regions, to float indefinitely. These recorders are  designed to deploy and emit alert messages even if the aircraft loses  power. The embedded emergency locator transmitter would send  Cospas-Sarsat satellites an alert every 50 seconds, including the aircraft  tail number, country of origin, location of aircraft at separation, and the  recorder’s current location.
Several aviation stakeholders—including airframe manufacturers, trade  associations, and U.S. domestic airlines—are divided in their support for  implementing deployable recorders on the commercial fleet. Boeing and  Airbus, for example, have publicly taken different positions. At the NTSB’s  forum on flight recorder technology in October 2014, Airbus  representatives announced the company’s tentative plans to install  deployable recorders on its future A350 and A380 long-haul fleets as a  second complementary system to a fixed combination FDR/CVR, though  specific timing is unknown. However, at the same forum, Boeing  representatives stated that the company had no plans to add deployable  recorders to its fleet and that the risk for unintended consequences  needed to be studied further.
Deployable recorders would offer several potential benefits, according to  stakeholders, including the following:
Faster and easier flight data location and retrieval: Since a  properly deployed and undamaged deployable recorder floats  indefinitely on the ocean surface and transmits an alert message  directly to Cospas-Sarsat for up to 150 hours, it may be easier for  searchers to locate and retrieve than a fixed recorder located on the  seabed. In the case of AF447, if equipped with a deployable recorder  that operated correctly, the device could have alerted searchers to its  location, and once found on the ocean’s surface, investigators would  have recovered the flight data more quickly than the 2 years it took to  locate and retrieve the fixed recorders from the ocean floor. Similarly,  if MH370 had a deployable recorder which operated correctly in the  event of a crash, investigators would generally know the location at  impact and could have recovered the flight data from the ocean’s  surface.
Updated location information: The alert messages transmitted from  the recorder after deployment could help investigators pinpoint the  crash site. Additionally, satellites can track the device’s drift pattern  from these messages for up to 150 hours, giving investigators  information on ocean currents that may move survivors and debris  away from the initial crash site.
No recurring service fees: Data transmission of the emergency  locator transmitter signals from a deployable recorder would be free  because Cospas-Sarsat has no service fees.
However, some stakeholders highlighted a number of concerns with  introducing deployable recorders into the commercial fleet:
Safety: A range of stakeholders that we spoke to, including an  airframe manufacturer, avionics manufacturers, and faculty from an  academic institution, identified potential safety risks to the aircraft,  passengers, maintenance technicians, and others on the ground from  inadvertent deployment. According to one manufacturer, even if the  industry had met its standard failure rate of less than one incident per  10 million flight hours for civil airborne systems and equipment, there  would have been an estimated five incidents involving deployable  recorders with the 54.9 million total commercial fleet hours in 2013.  These types of incidents could potentially cause damage to both  people and property. An airframe manufacturer and an avionics  manufacturer told us that the system would need to be designed to  ensure the safety of those on the ground and in the air, especially  given the infrequency of aviation accidents in which a deployable  recorder would be useful.
Infrequency of accidents and success of fixed recorder recovery:  One avionics manufacturer and two U.S. domestic airlines that we  spoke with questioned the need for deployable recorders given the  safety concerns discussed above and the infrequency of aviation  accidents. Additionally, when accidents do occur, investigators  typically locate and recover the flight data even for accidents  occurring over water. Investigators located and recovered the flight  recorders in 15 of the 16 commercial accidents, approximately 94  percent of cases that occurred over water since 2000.
Mixed recovery record in military aircraft: According to one  stakeholder, flight data recovery rates are actually better on fixed  FDRs compared to deployable recorders based on experience with  one military aircraft model. For instance, according to industry data of  a certain military aircraft that we reviewed from 2004 through 2014,  there was a 100 percent flight data recovery for fixed recorders  compared to 75 percent with deployable recorders. The causes of  those failures included instances in which the recorder did not deploy,  was not located, or did not have data on the memory card.
Does not mitigate the need to recover the aircraft wreckage and  fuselage, or human remains: While the flight recorders are an  important part of the accident investigation, investigators still want to  recover the aircraft wreckage and fuselage to help determine the  cause of the accident. Therefore, there would still be costs for an  underwater search and recovery even if investigators had the  deployable recorder.
Hardware costs: Deployable recorders would require adding more  equipment on the commercial fleet and, according to the FAA and two  avionics manufacturers, would result in additional costs to airlines.  The estimated cost is $50,000—$60,000 per unit, according to an  avionics manufacturer. We found that the total cost of equipage could  be as much as $29 million, and any additional costs associated with  certifying each aircraft type model, if this cost per unit were incurred  for the current total U.S. long-haul transoceanic fleet. However, for  several reasons it is difficult to extrapolate the per-unit cost estimate  to obtain a cost estimate for the total fleet. First, costs could vary  based on the type of aircraft, the regulatory environment, and other  engineering factors, so when widely deployed these factors may affect  the costs for varied contexts. Additionally, if a technology becomes  mandated or, even if voluntary, becomes widely adopted, unit costs  might decline due to the efficiencies of mass production and also  possibly due to a greater number of providers entering the market.
Given the safety concerns, costs of equipage, and the uncertain benefits  associated with deployable recorders, certain stakeholders, including one  airframe manufacturer, one trade association, and one avionics  manufacturer, suggested additional study is needed on the use of  deployable recorders in commercial aircraft. Additionally, several  stakeholders raised concerns about prescribing a specific technology—in  this case automatic deployable flight recorders—as opposed to a  performance-based approach when implementing or enhancing flight data  recovery capabilities, which is the preferred approach of both FAA and  the airline industry. Several stakeholders told us that industry needs the  flexibility of performance standards over prescriptive solutions due to the  diversity of the fleet and to allow for technological advances. FAA officials  described their position on deployable recorders as fluid and told us that  they did not have plans to mandate a deployable recorder, but also would  not prevent an operator from installing one provided the operator  adequately demonstrated an acceptable level of safety and  performance. In the GADSS framework, ICAO identifies the need to  develop performance-based standards for deployable recorders. At the  February 2015 Second High-Level Safety Conference, ICAO presented a  prescriptive baseline recommendation for deployable recorders and a  performance-based alternative, though it is unclear what that alternative  would be at this time. At the meeting, member states agreed with a  performance-based approach to data retrieval.
section_title: Triggered Transmission of Flight Data
paragraphs: In January 2015, NTSB issued a safety recommendation that all new  commercial aircraft used in extended overwater operations be equipped  with a means of recovering mandatory flight data that does not require  underwater retrieval, which builds on earlier efforts from the BEA in  response to AF447. While automatic deployable flight recorders as  discussed above could meet the recommendation, this performance- based approach also allows for a solution that involves triggering a  transmission of mandatory flight data from the aircraft to the ground  during emergencies. NTSB’s approach, if adopted by FAA, allows airlines  to choose a solution that fits best with their operations. The concept of  triggering the transmission of flight data to the ground consists of using  flight parameters to detect whether an emergency situation is  forthcoming, and if an emergency arises, transmitting data automatically  from the aircraft until either the emergency situation ends or the aircraft  crashes.
Industry stakeholders cited various potential benefits of triggered  transmissions of flight data.
Provides data when physical FDR cannot be recovered:  Streaming FDR data allows for post-flight analysis in instances where  the physical FDR or its data cannot be easily recovered, including  cases where a deployable FDR may not be recovered.
Faster flight data retrieval: Triggered transmission provides required  flight data without the need to recover the physical FDR, and  therefore, investigators would have data available to them more  quickly than if they had to initiate a potentially lengthy search for the  physical FDR or deployed FDR. Quicker access to flight recorder data  after an incident, especially in oceanic regions, could potentially allow  investigators to determine the accident’s cause more quickly. In the  case of AF447, if the FDR data were streamed from the aircraft before  impact, investigators could have had access to the FDR data more  quickly, which would have potentially avoided some of the lengthy  search and recovery effort.
Provides location information for aircraft in the event of an  accident: In addition to flight data, the transmission of position  information could be triggered at a rate that should allow investigators  to identify a narrower search area than would otherwise be known  through position reports sent at 15-minute intervals. This could  minimize the need for emergency locator transmitters, which as  discussed previously, several stakeholders told us have been  unreliable in providing crash location information.
However, stakeholders we interviewed raised several concerns about  implementing data streaming into the commercial fleet.
Bandwidth limitations: Stakeholders—including the FAA, an  airframe manufacturer, faculty from an academic institution, a U.S.  domestic airline, and two trade associations—told us that while it  would likely not be possible to stream FDR data continuously from  every aircraft in flight with current satellite capabilities, it could be  possible to stream FDR data in a limited number of emergencies.  However, a representative from an avionics manufacturer that sells a  flight data streaming product told us that streaming voice data was not  technically possible at the current time due to limited satellite  bandwidth. Therefore, investigators would still need to retrieve the  physical CVR to obtain audio information; such retrieval would limit  some of the potential benefits of triggered transmission.
Technical challenges: Two avionics manufacturers and an air  transport data communications provider also stated that it could be  technologically difficult for an aircraft in distress with its satellite  antenna not pointing in a fixed position prior to impact to transmit data  to satellites. However, there is at least one commercial product— FLYHT’s Automated Flight Information Reporting System—capable of  streaming up to all FDR data and position information in near real- time via satellites when triggered by an onboard emergency, and  according to this manufacturer, a test flight showed FDR data  transmission even when the plane was in an unusual position during  flight.
Data privacy and security: Flight recorder data are typically only  used for accident investigation purposes. NTSB told us that it was  unclear who would control and have access to streamed data and  emphasized the importance of validating the data before it becomes  public. As such, a few stakeholders raised privacy and security  concerns with streaming flight data. The NTSB’s primary concern is  having access to flight data to conduct an accident investigation and  NTSB officials stated that in the event of an accident in the United  States, they should be the first party to download flight recorder  information to ensure data integrity.
Does not mitigate the need to recover the aircraft wreckage and  fuselage, or human remains: Identical to the concern raised above  with deployable recorders, investigators still want to recover the  aircraft wreckage and fuselage in order to determine the cause of the  accident. Therefore, there would still be some cost for an underwater  search and recovery even if investigators had the streamed FDR data.
Equipage and data costs: Stakeholders, including FAA, airframe  manufacturers, a trade association, and a U.S. domestic airline,  stated that streaming flight recorder data could result in data  transmission costs to airlines, especially using satellite  communications over oceanic regions, and might require more  equipment on aircraft that comes at a cost. The cost of the FLYHT’s  Automated Flight Information Reporting System described above is  estimated at $70,000 per unit for parts and installation, according to  the manufacturer. Assuming that as an average cost, we found that  the total cost for the current U.S. long-haul transoceanic fleet could  approach $35 million. As noted above, however, extrapolating the  current per-unit cost estimate to estimate the cost for the entire fleet  has certain limitations. Furthermore, it would cost between $5—$10  per minute for data streaming during emergencies, according to the  manufacturer.
The FAA and other stakeholders told us that most aircraft could gather  similar data using existing systems, so adding additional equipment to  gather and transmit such information may not have an operational benefit  for airlines. Representatives from one U.S. domestic airline that we spoke  with told us that they did not see the need to equip their fleet with a new  device since their system for monitoring aircraft performance could  provide engine information through ACARS. Similarly, one airframe  manufacturer representative told us that ACARS has helped provide  information for accident investigations before FDR recovery. As noted  above, ACARS, which is equipped on all new aircraft, can be  programmed to transmit some aircraft operations data, including position  information, when certain triggers are met.
section_title: ICAO and NTSB Have Endorsed Cockpit Recorder Enhancements to Aid Accident Investigations, Though Privacy Issues Are Unresolved
paragraphs: ICAO announced support for extending the duration of the audio captured  by the CVR, and NTSB has reiterated its recommendation for installing a  cockpit image recorder. According to the NTSB, enhanced cockpit  recorders would provide investigators with more information during  accident investigations. Despite the potential value of this information to  accident investigation, concerns over privacy remain unresolved.
subsections: section_title: Increasing the Recording Time of the Cockpit Voice Recorder
paragraphs: The ICAO Second High-Level Safety Conference recognized the need to  increase CVR recording time to ensure that accident investigators had all  relevant flight data. The concern is that CVRs should record and retain  audio data for more than 2 hours given the possibility that MH370’s CVR,  which was designed to record on a continuous 2-hour loop, recorded over  critical events in the plane’s presumed 7-hour flight that could help  accident investigators. According to a representative from one avionics  manufacturer, 2 hours is insufficient and voice recordings should cover  the full duration of the flight like the FDR. Several manufacturers that we  spoke with stated that they could make CVRs with additional recording  time. One trade association representative told us that the CVR is meant  to supplement the information recorded by the FDR and cannot  definitively tell investigators what happened by itself and, therefore,  cautioned that enhancing subjective audio data may not be necessary if it  provides only a marginal improvement.
section_title: Installing a Cockpit Image Recorder to Aid Accident Investigation
paragraphs: NTSB, Safety Recommendation, A-00-30 and -31 (Washington, D.C.: Apr. 11, 2000);  NTSB, Safety Recommendations, A-15-1 through -8 (Washington, D.C.: Jan. 22, 2015). but they raised concerns that video, similar to audio data, is a subjective  and less precise means of information gathering than FDR data.  Therefore, they cautioned that video from an image recorder could lead to  misinterpretation of the situation. They also cited privacy concerns with  video information if improperly disclosed. The NTSB acknowledged the  privacy issues with recording images of pilots in its initial  recommendation, but also stated that given the history of complex  accident investigations and the lack of crucial cockpit environment  information, the safety of the flying public must take precedence.
section_title: Concluding Observations
paragraphs: In response to the AF447 and MH370 disasters, the international aviation  community is considering short- and long-term steps to improve aircraft  tracking and flight data recovery with the goal of enhancing accident  investigation and aviation safety. Numerous technologies—including  communications systems onboard most commercial aircraft today, flight  recorders that deploy from aircraft, devices capable of streaming flight  recorder data in real time, and global satellite surveillance systems under  development—have the potential to enhance aircraft tracking and  expedite flight data recovery in the event of an oceanic accident, and  industry continues to develop solutions for these tasks. However, some  industry stakeholders we spoke with cited concerns about these  technologies, such as the cost to equip the fleet and safety implications.  Additionally, as AF447 and MH370 make clear, global air traffic control’s  preparedness and capability to effectively monitor oceanic flights and  provide timely alerts in exceptional situations are important elements in  the debate. At the international level, ICAO is finalizing its Global  Aeronautical Distress and Safety System based on input from the 2015  High-Level Safety Conference, with formal adoption targeted for 2016.  These developments may represent the foundation for a comprehensive,  global approach to ensure that the location of an aircraft during all phases  of its flight is known to authorities. However, stakeholders expressed  concerns that international standards could prescribe adoption of certain  solutions, such as deployable recorders. They preferred a performance- based approach that encourages voluntary adoption because of the  flexibility such an approach affords industry in an era of rapidly evolving  technology. Additionally, the safety record in the National Airspace  System may make it difficult to demonstrate that the benefits of new  equipage on U.S. airlines outweigh the costs as part of a regulatory  analysis. Given the scope of the international processes that are  underway, we are not making any recommendations to FAA or NTSB  related to aircraft tracking or flight data recovery at this time. Ultimately,  we believe it is important for FAA to remain active through the ICAO  process to ensure that any new international standard for aircraft tracking  and flight data recovery is consistent with a performance-based approach  and is implemented in a globally harmonized manner.
section_title: Agency Comments
paragraphs: We provided a draft of this report to DOT and NTSB for review and  comment. Both DOT and NTSB provided technical comments that we  incorporated as appropriate.
As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies of this report to the  Secretary of Transportation, the Chairman of the National Transportation  Safety Board, and the appropriate congressional committees. In addition,  the report will be available at no charge on GAO’s website at  http://www.gao.gov.
If you or members of your staff have questions about this report, please  contact me at (202) 512-2834 or dillinghamg@gao.gov. Contact points for  our Offices of Congressional Relations and Public Affairs may be found  on the last page of this report. Major contributors to this report are listed  in appendix IV.
section_title: Appendix I: Organizational Affiliations of Aviation Industry Stakeholders GAO Interviewed
paragraphs: Appendix I: Organizational Affiliations of  Aviation Industry Stakeholders GAO  Interviewed Federal agencies  Federal Aviation Administration  International organizations  Flight Safety Foundation  International Civil Aviation Organization  Academic institution  Embry-Riddle Aeronautical University  FLYHT Aerospace Solutions Ltd.
section_title: Appendix II: Proactive Use of Flight Data by Federal Agencies and Industry
paragraphs: This appendix contains information describing how federal agencies and  the aviation industry use operational flight data. As we reported in 2010,  federal agencies and aviation industry stakeholders gather and analyze  aviation data for a variety of purposes. Federal agencies, including the  Federal Aviation Administration (FAA) and the National Transportation  Safety Board (NTSB), gather and analyze aviation data primarily to  improve safety. In addition, as we reported in 2010, the aviation industry  gathers quantitative and narrative data on the performance of flights and  analyzes these data to increase safety, efficiency, and profitability.  Aviation industry stakeholders are required to report some data to FAA— such as data on accidents, engine failures, and near midair collisions— and they have agreements with FAA and other agencies to share other  data voluntarily.
For decades, the aviation industry and federal regulators, including FAA,  have used data reactively to identify the causes of aviation accidents and  incidents. In recent years, FAA has shifted to a more proactive approach  to using data to manage aviation safety risk. The FAA continues to use  data to analyze past accidents and incidents, and is also using data  proactively to search for risks and address potential concerns in the  National Airspace System (NAS) before accidents occur or to improve  NAS efficiency. According to FAA officials, there is more safety data than  ever before, and these data provide the agency with the opportunity to be  more proactive about safety. FAA also recognizes that today’s aviation  safety, information-sharing environment is not adequate to meet the next  generation needs of the NAS. According to FAA, capabilities need to be  developed that can continuously extract operationally significant, safety- related information from large and diverse data sources; identify  anomalous events or trends; and fuse relevant information from all  available sources.
The FAA and the aviation industry have sought additional means for  addressing safety problems and identifying potential safety hazards. The  FAA has developed a number of programs to encourage the voluntary  sharing and industry-wide analysis of operational flight data. In addition to  enabling a more proactive approach to addressing safety concerns in the  NAS, according to FAA, these programs could potentially enable it to  predict the situations under which accidents could occur and take actions  to help prevent them before occurring.
Flight Operational Quality Assurance (FOQA): FOQA is a voluntary  safety program designed to improve aviation safety through the  proactive use of recorded flight data. Operators use these data to  identify and correct deficiencies in all areas of flight operations,  according to FAA. FAA officials told us that if properly used, FOQA  data can reduce or eliminate safety risks, as well as minimize  deviations from regulations. Through access to de-identified  aggregate FOQA data, FAA can identify and analyze national trends  and target resources to reduce operational risks in the NAS, air traffic  control, flight operations, and airport operations, according to FAA.  The value of FOQA programs, according to FAA, is the early  identification of adverse trends, which, if uncorrected, could lead to  accidents.
FOQA is a program for the routine collection and analysis of flight  data generated during aircraft operations. FOQA programs provide  more information about, and greater insight into, the total flight  operations environment. FOQA data are unique because they can  provide objective information that is not available through other  methods, according to FAA. FAA officials told us that a FOQA  program can identify operational situations in which there is increased  risk, allowing the airline to take early corrective action before that risk  results in an incident or accident. For example, according to  representatives from one airline, FOQA analysis and findings are  incorporated into flight crew training as well as airline policies and  procedures. The FOQA program is another tool in the airlines’ overall  operational risk assessment and prevention programs. As such,  according to the FAA, it must be coordinated with the airlines’ other  safety programs, such as the Aviation Safety Action Program and pilot  reporting systems, among others.
Aviation Safety Information Analysis and Sharing (ASIAS): FAA  and the aviation community have initiated a safety analysis and data  sharing collaboration to proactively analyze broad and extensive data  to advance aviation safety, according to FAA. The initiative, known as  ASIAS, leverages internal FAA data, airline proprietary safety data,  publicly available data, manufacturers’ data, and other data. FAA  officials told us that the airline safety data are safeguarded by the  MITRE Corporation, a federally funded research and development  center, in a de-identified manner to foster broad participation and  engagement. According to FAA, ASIAS fuses various aviation data  sources in order to proactively identify safety trends and assess the  impact of changes in the aviation operating environment.
ASIAS resources include both public and non-public aviation data.  Public data sources include, but are not limited to, air traffic  management data related to procedures, traffic, and weather. Non- public sources include de-identified data from air traffic controllers and  aircraft operators, including recorded flight data and safety reports  submitted by flight crews and maintenance personnel. According to  FAA, governance agreements with participating airlines and owners of  specific databases provide ASIAS analysts with access to safety data.  Governed by a broad set of agreements, ASIAS has the ability to  query millions of flight records and de-identified reports via a secure  communications network, according to FAA.
Under the direction of the ASIAS Executive Board, which includes  representatives from government and industry, ASIAS conducts  studies, safety assessments, risk monitoring, and vulnerability  discovery. In the interest of enhancing aviation safety, the results of  these analyses are shared with the ASIAS participants, according to  FAA. ASIAS has also established key safety benchmarks so that  individual airlines may assess their own safety performance against  the industry as a whole. According to aviation industry stakeholders  we spoke with, the key benefit of participating in this program for the  airlines is the opportunity to benchmark their individual performance  against the aggregate performance of the industry. Furthermore,  according to FAA, ASIAS serves as a central conduit for the exchange  of data and analytical capabilities among program participants. The  ASIAS vision is a network of at least 50 domestic and international  airlines over the next few years, making it the only such center of its  kind in the world.
System Safety Management Transformation (SSMT): This FAA  effort, which uses ASIAS and other data, seeks to move FAA from a  post-hoc, reactive assessment of aviation safety to a more predictive,  risk-assessment process. According to FAA, the SSMT project is  developing data analysis and modeling capabilities that will enable  FAA analysts to both determine how NextGen-related operational  improvements will affect safety and evaluate potential risk mitigation  strategies. One of the safety analysis methodologies the SSMT team  is developing is called the Integrated Safety Assessment Model. The  goal of this model is to 1) provide a risk baseline against which to  measure future system changes and 2) forecast the risk and safety  impacts of implementing changes to the NAS, including FAA’s  NextGen initiative. According to FAA, the model has been published,  but continues to evolve and efforts are currently under way to refine  and update its various components. The model is available as a web- based platform accessible through a user login account. According to  FAA, the goal of this work is to describe in a standard format the  causes and consequences of aviation accidents since 1996 as well as  to describe the precursor events that contributed to these accidents.  Using event sequence diagrams, FAA can describe the sequence of  events led to an accident. According to FAA, current results indicate  positive trends in overall impact as a means to analyze and assess  baseline risks as well as emerging risks.
Airlines and airframe manufacturers also use flight data, but primarily to  improve the efficiency of operations and increase profitability. As  described above, domestic airlines use data collected through FOQA  programs to enhance operations and proactively address maintenance  issues. Airlines also use data provided through the Aircraft  Communications Addressing and Reporting System (ACARS), a  communications system that transmits short text messages via radio or  satellite, to monitor aircraft and engine performance. According to  representatives from one airline we spoke with, these data can show  when certain systems and equipment need repair, and help the airline to  schedule repairs in order to keep the plane in service. Another airline  attributed their very low in-flight engine failure rate, in part, to proactive  analysis of airplane health data. Aviation stakeholders said that this type  of analysis can help identify the precursors to engine failure and help the  airline address problems before the entire aircraft has to be taken out of  service.
Finally, airframe manufacturers, such as Airbus and Boeing, have also  developed airplane health management programs, which are offered as a  service to the airlines. According to Boeing, Airplane Health Management  gives airlines the ability to monitor airplane systems and parts and to  interactively troubleshoot issues while the plane is in flight. Data collected  through these types of programs are captured in flight and transmitted in  real time to the airline’s ground operations. Airbus representatives told us  that their program is also designed to collect information from various  aircraft systems and determine probabilities and likelihood of equipment  failure. According to Boeing, airlines can use this service to make  maintenance decisions before the plane has landed and be ready for any  needed repairs as soon as the airplane arrives at the gate. This  information is used by airlines to support operational decisions to “fix-or- fly,” which result in reduced schedule interruptions and increased  maintenance and operational efficiency, according to Boeing. Boeing’s  Airplane Health Management was first introduced with the 747 and 777  aircraft models, but it has been thoroughly embedded in the design of the  787 model. To support the Airplane Health Management service for the  787, Boeing has a control center where each plane is tracked and its  systems are monitored. Similarly, Airbus representatives said their  airplane health management program supports the most recent aircraft  models.
section_title: Appendix III: List of Commercial Aviation Accidents and Recovery over Water from 2000—2015
subsections: section_title: No. 1
paragraphs: Airbus A320  Karimata Strait,  Java Sea (off the  coast of Pangkalan  Bun, Indonesia)
Malaysia Airlines Flight 370   Boeing B777  Southern Indian  Ocean west of  Australia  (Presumed)
Ethiopian Airlines Flight 409  Boeing B737  Mediterranean Sea  (Beirut, Lebanon)
Airbus A310  Moroni, Comoros  Islands (off the  coast of West  Africa)
Airbus A320  New York, USA  (Hudson River)
Off the coast of  Moorea, French  Polynesia  Boeing B737  Makassar Strait (off  the coast of  Sulawesi,  Indonesia)
Airbus A320  Black Sea (off the  coast of Sochi,  Russia)
Off the coast of  Palermo, Italy  Boeing B747  Taiwan Strait  (northeast of  Makung, Penghu  Islands)
section_title: No. 15
paragraphs: Pacific Ocean (north  of Anacapa Island,  California)
Airbus A310  Abidjan (Off the  Ivory Coast, West  Africa)
section_title: Appendix IV: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, the following individuals made  important contributions to this report: Andrew Von Ah, Assistant Director;  Amy Abramowitz; Nabajyoti Barkakati; Jonathan Carver; Leia Dickerson;  Chris Falcone; Geoff Hamilton; Bert Japikse; Delwen Jones; Josh  Ormond; Madhav Panwar; Justin Reed and Elizabeth Wood.