Aviation Safety: Proposals to Enhance Aircraft Tracking and Flight Data Recovery May Aid Accident Investigation, but Challenges Remain
Released: 2015-05-18T00:00:00

Letter

Background

On a typical day, approximately 100,000 flights around the world reach their destinations without incident, and the safety of the global air transportation system has continued to improve in recent years. The United States air transport system, in particular, is experiencing one of the safest periods in its history. The FAA, an agency of the Department of Transportation, is primarily responsible for the advancement, safety, and regulation of civil aviation, as well as overseeing the development of the air traffic control (ATC) system. The FAA’s stated mission is to provide the safest, most efficient aerospace system in the world. Air traffic control on a global level is coordinated by ICAO, which establishes global standards for air navigation, air traffic control, aircraft operations, personnel licensing, airport design, and other issues related to air safety.

FAA collaborates with ICAO in setting standards and procedures for aircraft, personnel, airways, and aviation services domestically and throughout the world.

Air navigation service providers (ANSPs) are organizations authorized to provide air navigation services. For example, FAA’s Air Traffic Organization is responsible for providing safe and efficient air navigation services in U.S. airspace. Air traffic services units provide air traffic control, flight information, and alerting services in portions of airspace called flight information regions. According to Annex 11 to the Convention on International Civil Aviation, air traffic control is provided to prevent collisions and expedite and maintain an orderly flow of air traffic, among other things. Surveillance plays an important role in air traffic control as the ability to accurately and reliably determine the location of aircraft has a direct influence on how efficiently a given airspace may be utilized. Additionally, according to ICAO, surveillance can be used as the basis for automated alert systems, as the ability to actively track aircraft enables air traffic control to be alerted, for example, when an aircraft deviates from its altitude or route. Radar is a surveillance technology that provides the air traffic controller with an on-screen view of aircraft position. Air traffic control uses radar to determine the position of aircraft and the aircraft’s reported altitude at a given time when traveling over land or coastlines. An aircraft’s transponder automatically transmits a reply when it receives an interrogation radio signal from ground radar stations. During the cruise portion of a flight within radar coverage, the aircraft’s position is reported at least every 12 seconds, depending on the rotational speed of the ground radar antenna. FAA and its aviation counterparts in other parts of the world—including Europe, Asia, and Australia—are in the process of transitioning from radar-based surveillance to a system using Automatic Dependent Surveillance-Broadcast (ADS-B), which once implemented, is expected to provide air traffic controllers and pilots with more accurate information to help keep aircraft safely separated in the sky and on runways.

In areas without radar or ADS-B coverage—including oceanic airspace, remote geographic regions such as the North and South Poles, and some areas in Africa, Asia, and South America—pilots use radio communications systems to report the position of their aircraft to air traffic control. According to FAA guidance for oceanic and international operations, aircraft are to report their position to the ANSP responsible for the airspace where the aircraft is operated and should do so before passing from one flight information region to another. On routes that are not defined by designated reporting points, aircraft should report as soon as possible after the first 30 minutes of flight and at hourly intervals thereafter, with a maximum interval between reports of 1 hour and 20 minutes. On oceanic routes, aircraft should report their position at all designated reporting points, as applicable; otherwise, flights should report their position at designated lines of latitude and longitude. Aircraft flying in oceanic airspace may be equipped with additional avionics and satellite communications capabilities, such as the Future Air Navigation System (FANS), which creates a virtual radar environment to allow air traffic control to safely place more aircraft in the same airspace.

ICAO requires that, at a minimum, aircraft operating over oceans must have a functioning two-way radio to communicate with the appropriate air traffic control unit. FAA requires Part 121 operators (i.e., scheduled commercial air carriers) to carry certain communication and navigation equipment for extended over-water operations. For example, aircraft of these operators must have at least two independent long-range navigation systems and at least two independent long-range communication systems to communicate with at least one appropriate station from any point on the route. software, which is integrated with an aircraft’s flight management system, provides a means for digital transmission of short messages between the aircraft and ATC using radio or satellite communication systems. To fly at optimum altitudes in the North Atlantic—the busiest oceanic airspace in the world—operators were required to equip with FANS by February 5, 2015. Aircraft equipped with FANS can transmit Automatic Dependent Surveillance-Contract (ADS-C) reports, which may include information on the plane’s current position and intended path to air traffic control. Position reports sent through ADS-C transmit at defined time intervals, when specific events occur such as a sudden loss of altitude, or based on a request from air traffic control.

In addition to the role of surveillance in air traffic control, FAA requires commercial airlines conducting scheduled and nonscheduled operations under part 121 of federal aviation regulations to have a flight following system in place to ensure the proper monitoring of the progress of each flight from origin to destination, including intermediate stops and diversions. Major airlines monitor the progress of flights from their operational centers using technologies such as the Aircraft Communications Addressing and Reporting System (ACARS), a communications system used predominantly for transmission of short text messages from the aircraft to airline operational centers via radio or satellite communication.

When an aircraft is in distress, or does not communicate as expected, air traffic control’s responsibility for providing alerting services is provided in Annex 11 to the Convention on International Civil Aviation. There are 3 phases intended to notify search and rescue services to take appropriate measures, including:

Uncertainty phase: Established when communication has not been received from the crew within the 30-minute period after a communication should have been received.

Alert phase: Established when subsequent attempts to contact the crew or inquiries to other relevant sources have failed to reveal any information about the aircraft.

Distress phase: Established when more widespread inquiries have failed to provide any information, and when the fuel on board is considered to be exhausted.

ICAO members establish search and rescue regions to provide communication infrastructure, distress alert routing, and operational coordination for supporting search and rescue services.and rescue regions, aeronautical rescue coordination centers are responsible for the search and rescue operations prompted by an aviation accident. ICAO encourages countries, where practicable, to combine their search and rescue resources into a joint rescue coordination center with responsibility for both aeronautical and maritime search and rescue.

Search and rescue authorities may be alerted to distress situations by satellite constellations operated by the International Cospas-Sarsat Program that detect transmissions from an aircraft’s emergency locator transmitter. The emergency locator transmitter may be automatically activated by the shock typically encountered during an emergency or manually by a member of the flight crew. Satellites detect an activated transmitter and send the signals to ground stations, which determine the transmitter’s position and report to search and rescue authorities. Individual countries are responsible for providing these services.

In the rare event of a disaster, after any survivors have been rescued, physical recovery of the aircraft’s wreckage and the flight data recorder (FDR) and cockpit voice recorder (CVR)—commonly referred to as the black boxes—from the crash site is a priority in order to determine the cause of and circumstances surrounding the accident. After recovering the recorders, each about 20 pounds and roughly the size of a shoebox, investigators from civil accident investigation authorities—such as the NTSB in the United States or the French Bureau d’Enquêtes et d’Analyses (BEA)—download and analyze data on flight conditions and the cockpit’s audio environment. Other potential sources of information that can help determine the cause and circumstances of an aviation accident include any communications between the flight crew and air traffic control, radar track history, data transmitted from various systems onboard the aircraft, aircraft wreckage, and the crash site.

ICAO standards for flight recorders, established in Annex 6 to the Convention on International Civil Aviation, are based on aircraft weight and provide that flight data recorders and cockpit voice recorders should retain the information recorded during at least the last 25 hours and 30 minutes of operation, respectively. FAA establishes the domestic regulations, policies, and guidance for the certification and airworthiness of flight recorders, as it does for other equipment and instruments on part 121 aircraft. In general, turbine powered commercial aircraft operating under part 121 must have a flight data recorder and a cockpit voice recorder, both of which undergo extensive testing to minimize the probability of damage resulting from a crash. See figure 1 for more detailed information on the FDR and CVR components.

Recent Air Disasters Highlight Challenges Related to Surveillance in Oceanic Airspace, ATC Communication, and Underwater Searches

Aircraft Can Be Difficult to Locate in Oceanic Airspace because of Surveillance Limitations and the Potential for Aircraft Communications Systems to Be Disabled

Surveillance limitations in oceanic airspace and disabled aircraft communications systems may make it more difficult to determine the precise location of an aircraft in distress or an accident site. Over land, radar monitors aircraft position in real time but coverage diminishes more than 150 miles from coastlines or in remote airspace such as the polar regions. In non-radar environments, flight crews rely on procedural surveillance by periodically reporting their position to air traffic control when passing certain waypoints on their flight plan. Intervals between position reports vary, but aircraft in oceanic and remote airspace should report their position at least every 80 minutes, according to FAA guidance for oceanic operations. According to one avionics manufacturer, it may take a flight crew 10 to 20 minutes to report their position using high frequency (HF) radio due to the disruptions caused by weather and atmospheric conditions over the oceans. Given that an aircraft cruises at speeds of more than 500 miles per hour (depending on altitude), an aircraft could travel more than 167 miles between 20-minute position reports, in comparison to radar’s ability to determine an aircraft’s location at least every 12 seconds. An aircraft reporting every 80 minutes could travel more than 600 miles between position reports. In airspace with less air traffic, such as remote oceanic regions, air traffic control does not require continuous contact with aircraft to maintain safe separation. Even more frequent position reports may not provide precise information on the aircraft’s location. For example, during its scheduled flight to Paris on June 1, 2009, AF447’s last regular ACARS position report was sent at 02:10 Coordinated Universal Time (UTC)maintenance messages were transmitted between 02:10 and 02:15, the approximate time of the plane’s crash. Based on the time the last ACARS message was received, investigators established a search area of more than 17,000 square kilometers, more than 500 nautical miles from any coastline, with a radius of 40 nautical miles centered on the plane’s last known location. MH370’s communications systems also included ACARS, but as discussed below, this system and other onboard systems stopped transmitting data during flight.

Additionally, air traffic control and airline operation centers may be unable to determine an aircraft’s location if communications equipment onboard the plane is damaged, malfunctioning, or has been manually turned off. For example, MH370 departed from Kuala Lumpur at 16:42 UTC on March 8, 2014 on a scheduled flight to Beijing, China. According to the Australian Transport Safety Bureau, the agency leading the search for the plane, MH370’s flight path includes three distinct sections: 1. an initial stage after takeoff in which the aircraft was under secondary radar, the transponder was operational, and ACARS messages were being transmitted; 2. a second stage in which onboard communications equipment were no longer working and the plane was only being tracked by military radar; and 3. a final stage in which the only available information on the flight’s path comes from satellite communications log data.

At 17:07, the aircraft transmitted its final automatic ACARS message, which included the weight of the fuel remaining on board. The flight crew’s last radio contact with Malaysian air traffic control occurred at 17:19 and then MH370 lost contact with air traffic control during a transition between Malaysian and Vietnamese airspace at 17:22. At 18:22, Malaysian military radar tracked MH370 flying northwest along the Strait of Malacca; this was the final radar data indicating the airplane’s position. After disappearing from military radar, MH370’s satellite communications system exchanged seven signaling messages—also referred to as “handshakes”—with the ground station, a satellite over the Indian Ocean, and the aircraft’s satellite communications from 18:25 until 00:19. According to the Australian Transport Safety Bureau, the final signaling message, a log-on request from the aircraft, indicates a power interruption on board that may have been caused by an exhausted fuel supply. At 01:15, MH370 did not respond to the signaling message from the ground station. Using the handshake data to determine that it continued to fly for several hours after disappearing from radar and estimates of the aircraft’s range based on the fuel quantity included in the final ACARS message, investigators placed MH370’s final location somewhere in Australia’s search and rescue region on an arc in the southern Indian Ocean. The current phase of the search is focused on an area of approximately 60,000 square kilometers.

Communication and Coordination among ATC, Operators, and Search and Rescue Authorities in Oceanic Areas Can Be Challenging

Communication and coordination between air traffic control centers can be difficult in oceanic and remote areas. As discussed previously, responsibility for global air traffic control is divided geographically by flight information region. Over the course of an oceanic flight, an aircraft may transition frequently between flight information regions in areas in which the ability to communicate with air traffic control can be limited. With respect to AF447, the TASIL waypoint in the Atlantic Ocean is located on the boundary between the Brazilian and Senegalese flight information regions. According to the final report on the investigation of the AF447 accident, controllers from the Atlantico Area Control Center in Brazil— which had been in contact with the aircraft—and the adjacent Dakar Oceanic Area Control Center in Senegal—which never established contact with the aircraft—stated that the quality of the HF radio reception was poor the night of the accident, resulting in recurring communication problems. The report found that there were powerful cloud clusters on the route of AF447, which may have created notable turbulence. The Atlantico controller last had contact at 01:35, when the crew read off their altitude and flight plan. Over the next minute, the controller asked the crew three times for its estimated time to cross the TASIL waypoint but received no response. The flight, however, did not encounter serious problems until 02:10 and the accident occurred in the Atlantico region at approximately 02:14. The crew should have established contact with Dakar air traffic controllers at approximately 02:20 when the aircraft was due to pass the TASIL waypoint. Dakar controllers stated that they were not concerned about the absence of radio contact with AF447 given the HF problems that night and since aircraft frequently crossed all or some of the Dakar flight information region without making radio contact. The AF447 final report concluded that the radio communication problems and meteorological conditions resulted in the controllers considering the situation (i.e., no contact with the flight) as normal. Furthermore, there were several communications breakdowns at critical junctures. Specifically, the report noted the lack of contact between the Atlantico controller and the flight crew before the transfer to the Dakar controller and the lack of contact between the Atlantico and Dakar controllers after AF447’s projected passage of the TASIL waypoint, both of which indicated that air traffic control had not effectively monitored the aircraft. The report also noted that a timely alert was not triggered because the controller in each region failed to communicate with the other as each individual controller anticipated. See figure 2 for a timeline of the AF447 accident.

Furthermore, according to the AF447 final report, information inquiries regarding the aircraft were not coordinated, resulting in air traffic control, search and rescue, and the operators questioning each other without making a decision about what action to take. Although the last contact with AF447 occurred at approximately 01:35, it took more than 9 hours for search teams to take off from Senegal and Brazil. The first search plane arrived at the TASIL waypoint approximately 13 hours after the crash. Contrary to ICAO standards and recommended practices, Brazil and Senegal did not have a search and rescue protocol. Consequently, the Brazilian and Senegalese rescue coordination centers were not aware of each country’s available resources, and the report stated that it was not possible to quickly identify one aeronautical rescue coordination center to lead the search and rescue mission. In the absence of a protocol, the report noted that the rescue coordination centers wasted considerable time gathering information and determining whether to trigger a search. The report also noted that there was a lack of coordination within the French aeronautical rescue coordination center and with its foreign counterparts in organizing the search and rescue. After being informed by Air France about a series of failure messages issued by the aircraft to its maintenance center in France, authorities from the French aeronautical rescue coordination center considered themselves not competent to intervene in a zone outside their area of responsibility. The report noted that this belief could be explained by ineffective training for search and rescue agents, particularly in terms of coordination with foreign counterparts. The French aeronautical rescue coordination center also provided key information to organizations that were not, according to the final report, competent in search and rescue; for example, one of the organizations failed to forward the last known position of the aircraft from an ACARS message.

MH370 also highlights the complexities of coordinating search and rescue activities in areas with multiple flight information regions when the final location of the plane is unknown. As noted earlier, MH370 departed from Kuala Lumpur at 16:42 UTC on March 8, 2014. At 17:19, Kuala Lumpur air traffic control instructed MH370 to contact Ho Chi Minh air traffic control, and the flight crew acknowledged this request over the radio. According to the interim report issued by the Malaysia Ministry of Transport’s Safety Investigation Team for MH370, another contact should have occurred at about 17:22 when MH370 passed the IGARI waypoint, but MH370 lost contact with ATC during the transition between Malaysian and Vietnamese airspace. The Ho Chi Minh City air traffic control center contacted the Kuala Lumpur air traffic control center at 17:39 to inquire Thereafter, according to the report, about the whereabouts of MH370.Kuala Lumpur initiated efforts involving the Malaysia Airlines operations center and Singapore, Hong Kong, and Phnom Penh air traffic control centers to establish MH370’s location, a process that lasted nearly 4 hours. The Kuala Lumpur aeronautical rescue coordination center transmitted the first distress message related to MH370 at 22:32—more than 5 hours after the last message expected from the crew—to begin search and rescue operations in the South China Sea based on the aircraft’s last known position. According to the report, Malaysian search and rescue aircraft took off heading to the search areas at 03:30.

Underwater Searches for Flight Recorders Are Difficult

After an aviation accident, investigators have typically been able to recover the flight recorders in a matter of days or weeks. We reviewed data on the 16 commercial plane crashes over water that occurred globally since 2000. Additional information on each of the 16 accidents is found in appendix III. In two instances—AF447 and MH370—search and recovery efforts for the recorders exceeded 1 year. In these cases, recovery of the flight recorders was hampered because investigators did not know the precise location of the crash site. The search for AF 447 involved a 17,000 square kilometer area, and the ongoing search for the wreckage of MH370 is focused on 60,000 square kilometers in the southern Indian Ocean. Additionally, the complexities of the underwater environment may hamper efforts to retrieve recorders. While authorities located some debris from AF447 in a remote section of the Atlantic Ocean within a few days of the accident on June 1, 2009, they were unable to locate the recorders during that time. The first phase of the BEA’s search for the recorders focused on the underwater locator beacons. Batteries in the current beacons are designed to allow the signal to be transmitted for at least 30 days and its range is typically limited to less than 3 nautical miles depending on water’s depth, underwater topography, and surrounding conditions. If the location of the crash cannot be determined within 30 days, the time available to search for the recorders while the beacons’ batteries have life is limited. The search for AF447’s beacons using a towed pinger locator followed the airplane’s projected trajectory in the Atlantic but was unable to detect an acoustic signal within the minimum 30-day transmission period. From July 2009 to April 2011, the BEA attempted to locate the wreckage and recorders in several search phases using sonar detection, evaluation of aircraft debris drift, and satellite-tracked buoys, each time unsuccessfully. After identifying the wreckage site at a depth of more than 12,000 feet, investigators ultimately found the flight recorders in May 2011 amid aircraft debris scattered on the seafloor. The BEA subsequently determined that the cockpit voice recorder’s beacon was damaged on impact while the beacon on the flight data recorder separated and was never found. As a result of these challenges, the search for the plane’s flight recorders took 2 years and cost an estimated $40 million.

Near-Term Proposals Do Not Fully Address Flight Tracking Challenges, but Long- Term Solutions Are under Development

In response to MH370, the international aviation community has undertaken a number of efforts to improve global aircraft tracking. In the near term, a task force formed by the International Air Transport Association (IATA) developed a set of voluntary performance standards that call for position reporting every 15 minutes with the capability to increase the reporting rate in case of emergency. Several technologies that are already on board most domestic aircraft can be used to meet this standard, although airlines would face some costs to equip if they do not already have those systems or satellite communications equipment. Over the longer term, ICAO has proposed a comprehensive new aircraft tracking framework designed to ensure that accurate information about the aircraft’s location is known at all times. In addition to incorporating the industry recommendations on aircraft tracking, the new concept also proposes an autonomous distress tracking system, an alternative to underwater flight data retrieval, and new procedures to improve coordination and information sharing during emergencies.

Most Long-Haul Aircraft Are Equipped with Technologies That Can Transmit Location Information, but More Frequent Position Reporting Can Add Costs to Airlines, and Some Challenges Remain

In the aftermath of the MH370 tragedy, the international aviation community has undertaken a number of efforts to improve global aircraft tracking capabilities. For example, just weeks after the disappearance of MH370, ICAO convened a special meeting to study issues related to aircraft tracking, and international stakeholders agreed to accelerate the timeframes for a new aircraft tracking approach, according to the U.S. ambassador to ICAO. In addition, IATA, which represents the international aviation industry, formed an Aircraft Tracking Task Force (Task Force) that focused on what airlines could do to support aircraft in the near term using existing technologies. The Task Force developed a set of voluntary performance standards to establish a baseline aircraft The tracking capability for all commercial passenger aircraft worldwide.key aircraft tracking performance standards proposed by the Task Force include:

Position reporting every 15 minutes, with capability to increase the reporting rate in response to an emergency. This performance standard calls for regular and automatic transmission of aircraft position information. The 15-minute frequency reflects the optimal balance between the benefit of knowing flight location with greater precision and the costs of transmitting data, as well as the cost of search and rescue operations, according to the Oceanic Position Tracking Improvement and Monitoring Initiative. The Task Force also called for any aircraft tracking system to have the capability to report more frequently when certain circumstances are met, such as unusual change in the trajectory, vertical speed, or altitude of the aircraft. The purpose of the increased position reporting rate is to narrow the search zone for an aircraft in distress.

Position reports should include latitude, longitude, altitude, and time information. This performance standard calls for position reporting in four dimensions. Latitude and longitude provide the aircraft’s location on a map, while altitude and time provide other data points to pinpoint the precise position of the aircraft at any stage of the flight.

Communications protocols between the airline and air traffic service provider to facilitate coordination in case of an emergency situation. The Task Force recognized that there is a need both to amend existing procedures and to develop new or improved communications protocols between airlines and air traffic service providers. The purpose of this performance standard is to establish communication procedures and protocols to better respond to instances of missing position reports or other unexplainable developments.

In order to achieve this baseline aircraft tracking standard, the Task Force recommended that aircraft operators evaluate their capabilities, implement measures to meet the performance standards within 12 months, and exchange best practices. According to the Task Force, these standards and recommendations are designed to improve the collective ability of the airline industry to identify and track aircraft globally. The Task Force also recognized that near-term procedures are just first steps in a longer-term, integrated concept of operations for aircraft tracking during all phases of flight. This concept of operations is discussed further below.

Several technologies could be used to meet the recommended aircraft tracking performance standards, according to the Task Force and aviation stakeholders we interviewed. For instance, ACARS- and FANS-equipped aircraft can be configured to report aircraft position information, even though ACARS is not specifically designed for that function and FANS is designed to report to air traffic control, not to airlines. According to the Task Force, ACARS uses information derived from the aircraft’s flight management system to report the aircraft’s position, and ACARS is configurable for enhanced reporting triggered by unanticipated altitude changes or flight levels below a predetermined altitude. For aircraft that are equipped with FANS, the airline ground systems can be configured to access information about the position of the aircraft, using Automatic Dependent Surveillance-Contract (ADS-C)—an application that allows the airline or air traffic control to establish a contract with the FANS system onboard the aircraft to deliver four dimensional position and other data at single, periodic, or event-based intervals. In addition, other benefits of FANS include reduced separation between aircraft, more direct routings leading to reduced fuel consumption, and improved communication clarity between the pilot and air traffic control. Other commercially available systems, including FLYHT Aerospace Solution’s Automated Flight Information Reporting System, would also meet the proposed performance standards by providing operators with precise information about the aircraft’s position in real-time, according to the manufacturer.Passenger Wi-Fi systems, which utilize satellite connectivity, could also be used to facilitate aircraft tracking, according to representatives from one domestic airline.

The level of equipage for these various technologies differs across the U.S. and global fleet. According to one of the major air transport communications service providers, almost all commercial passenger jet aircraft operators in the U.S. install and use ACARS, including nearly all regional airlines. Three major domestic passenger airlines that we spoke to also confirmed that their entire fleets are equipped with ACARS. Generally, airlines based outside the U.S. use ACARS, except some low- cost airlines that have avoided the cost of installing ACARS avionics and use only very high-frequency (VHF) voice radio or other solutions, according to one air transport communications service provider.

According to some aviation stakeholders we spoke to—including FAA, two domestic airlines, and one of the major air transport communications service providers—fewer airlines have equipped with FANS because it is only beneficial to the airlines when flying in certain, higher density oceanic airspace. FAA officials we spoke to estimated that approximately 70—80 percent of the aircraft operating in the busy North Atlantic airspace are currently FANS-equipped because it is required to access the optimal routes. According to one air transport communications service provider, FANS equipage on short-haul aircraft is very low, but is expected to increase because aircraft will need FANS avionics to be able to communicate with certain components of FAA’s Next Generation Air Transportation System (NextGen) in the future. Airlines that wish to take advantage of the optimal flight paths between North America and Europe will need to be FANS-equipped by 2015; therefore, FANS equipage is expected to increase in the future, according to FAA. Representatives from one large domestic airline said they are installing FANS on all of their aircraft used for international operations largely because of its operational and safety benefits. Another airline that we spoke to is also planning to equip its aircraft that operate from the U.S. West Coast to Hawaii because of the operational efficiencies expected by using FANS. Finally, two major airframe manufacturers told us that all new aircraft typically come equipped with the latest communications, navigation, and surveillance avionics, including ACARS and FANS, but the operator chooses to enable the system depending on where the aircraft is used.

Despite their benefits, the technologies that could be used to achieve the Task Force’s baseline aircraft tracking standard in the near term do not address all the challenges associated with locating flights. For example, according to one major airframe manufacturer, neither ACARS nor FANS is tamper-proof, which means that a knowledgeable individual could disable both systems and the aircraft’s transponder. Should those systems and the transponder be turned off, the aircraft would be incapable of sending position data. Aviation stakeholders told us that there are legitimate engineering and operating reasons for the flight crew to have total control over all on-board systems. According to one major airframe manufacturer, aircraft are designed with the assumption that the pilot and flight crew are trusted and should have complete control over the aircraft. In certain situations, air traffic control may ask a pilot to turn the transponder off and back on to identify an aircraft. Other stakeholders we spoke to said that the pilot’s ability to turn off any system on board the aircraft is based first and foremost on safety considerations. Nevertheless, at least two major international airlines have called for a tamper-proof aircraft tracking solution.

Should they choose to adopt the technologies described above, airlines that currently do not meet the Task Force aircraft tracking performance standards would face some costs. Estimates of those costs across the fleet are difficult to determine with any precision because data on the level of aircraft equipage were not consistently available and the contracts between the airlines, avionics manufacturers, and air transport communications service providers to provide such services are proprietary. Costs to equip with ACARS using VHF radio could be up to $100,000 per aircraft. Additionally, ACARS using satellite communications would cost another $60,000 to $150,000 per aircraft for Iridium or Inmarsat equipment, according to one air transport communications service provider. However, according to the airframe manufacturers we spoke with, most long-haul aircraft that fly in oceanic and remote regions are already equipped with those units. For aircraft without FANS, there would be an additional cost of up to $250,000 for a new FANS-capable flight management system, according to one air transport communications service provider. Costs for FLYHT Aerospace Solution’s Automated Flight Information Reporting System, a commercial system that could, among other things, provide aircraft position data, were approximately $70,000 per system, including installation labor per aircraft but not the cost of data transmission, according to company representatives.

In order to more frequently report position information using ACARS or FANS, airlines may have to pay for increased data transmission, but we were unable to determine the extent of these costs to industry. According to one air transport communications service provider, ACARS data transmission costs per month can range from $500 per short-haul aircraft using VHF radio systems, to approximately $1,000 per aircraft for long- haul aircraft using satellite communications over oceans. According to one domestic airline, airlines pay for ACARS messages through plans similar to cellular text messaging, and therefore, it is not clear whether more frequent position reports would be covered under existing plans, or would require new plans at a higher cost.

To help mitigate these costs and enhance tracking capabilities in the near term, aviation stakeholders have offered a number of proposals to enhance flight tracking. One proposal offered by the satellite communications provider Inmarsat would provide four free position reports per hour using FANS ADS-C capability. To take advantage of this proposal, aircraft would need to be equipped with FANS and Inmarsat satellite communications. A separate proposal from SITA, a major provider of ACARS data, aims to provide ADS-C reports to airlines. According to SITA, the company’s proposal may help improve coordination between the airline and the air navigation service provider, especially if there is an unexpected event onboard the aircraft. Rockwell Collins, the other major providers of ACARS data, unveiled a flight tracking service in March 2015 that utilizes several data sources, including ADS-B, ADS-C, and ACARS. Over the longer term, other aircraft surveillance systems may become available that build on FAA’s transition to NextGen. Aireon, a joint venture between four air navigation service providers—Nav Canada, ENAV (Italy) and the Irish Aviation Authority, and Naviair (Denmark)—as well as the satellite service provider Iridium, aims to use ADS-B technology on satellites to provide a global aircraft surveillance system. According to Aireon representatives, its space-based ADS-B system is scheduled to be fully deployed in 2017, although the system would not be operational until after a test and validation phase is completed, which is currently planned for early 2018. The real-time surveillance costs provided by this system are being discussed with individual air navigation service providers at this time. Aviation stakeholders we spoke to recognize the potential of this spaced- based surveillance system in terms of enhancing aircraft tracking in oceanic and remote regions. Aireon has also announced a free service to be offered using the space-based ADS-B system—Aircraft Locating and Emergency Response Tracking (ALERT)—that would provide the last known or current location of any aircraft equipped with ADS-B technology to search and rescue teams in emergency situations.

ICAO’s Long-Term Framework for Aircraft Tracking during All Flight Phases Proposes Tamper- Proof Autonomous Distress Tracking, but Poses Several Implementation Challenges

In parallel with the Aircraft Tracking Task Force, an ICAO-led Ad-Hoc Working Group on Flight Tracking developed a long-term framework— called the Global Aeronautical Distress and Safety System (GADSS)—to ensure that accurate information about the aircraft’s location is known during the sequence of events before and after an accident. Both industry and ICAO worked to harmonize their proposals, according to stakeholders involved in the process, and at ICAO’s High-Level Safety Conference in February 2015, delegates from over 120 nations endorsed the GADSS framework for aircraft tracking. This framework is designed to maintain an up-to-date record of aircraft progress and, in the case of a forced landing, the location of survivors, the aircraft, and the flight recorders.Force recommendations on tracking aircraft, but goes further, as described below.

The GADSS consists of four key system components:

Aircraft tracking system: This tracking system incorporates the Task Force’s near-term recommendations to enhance aircraft tracking, as described above, and specifies that when an abnormal event is detected, the position reporting rate of the aircraft tracking system increases to around a 1-minute interval, an increase that translates to knowing the aircraft’s position within 6 nautical miles; such reporting can be achieved with the systems discussed previously.

Autonomous distress tracking system: The GADSS framework goes further than the Task Force standards by calling for an autonomous distress tracking system. According to the Ad-Hoc Working Group, an autonomous distress tracking system operates independently from the regular aircraft tracking system and may be automatically or manually activated at any time. This system could be automatically triggered by unusual attitude, speed or acceleration, failure of the regular aircraft tracking system or surveillance avionics, or a complete loss of engine power. aircraft power or other systems, and be tamper-proof.

In addition, the system would operate independently of

Automatic deployable flight recorder: The GADSS proposal currently calls for an automatically deployed flight recorder. This device is designed to automatically separate from the aircraft in the event of an accident. At the February 2015 High-Level Safety Conference, ICAO proposed the use of deployable recorders or an alternative for data retrieval. Additional information about deployable flight recorders is provided later in this report.

Procedures and information management: The final component of the GADSS aircraft tracking framework recognizes that the effectiveness of any search and rescue service is only as good as the weakest link in the chain of people, procedures, systems, and information. Therefore, in addition to the technology, the GADSS identifies key areas of improvement, such as existing procedures, improved coordination and information sharing, and enhanced training of personnel in reacting to emergency circumstances.

According to ICAO, the performance specifications for the in-flight triggering criteria and broadcasting rate to be used are still under development.

System Wide Information Management consists of standards, infrastructure, and governance enabling air traffic management information and its exchange between qualified parties via interoperable services, according to ICAO. assessment of the shortcomings in coordination and information sharing between air navigation service providers and search and rescue authorities is needed. Moreover, the GADSS also calls for the development of guidance material and training on emergency situations for air navigation service providers. These efforts outlined in the GADSS are essential; however, the steps to strengthen the people, procedures, systems and information sharing must be carried out by individual countries.

Improvements to Flight Data Recovery Are Starting with Extended Beacons, While Other Proposals May Impose Significant Costs, according to Stakeholders

In response to recent aviation accidents, government, international organizations, and industry have been developing proposals to enhance flight recorder recovery in oceanic regions. In the near term, manufacturers are scheduled to begin adding extended batteries on the underwater locator beacons (ULBs) attached to flight recorders and have the option to add a second low-frequency device. Longer-term proposals to equip commercial aircraft with automatic deployable flight recorders and the capability to stream up to all FDR data are in various stages of development. Some have also called for enhanced cockpit recorders to aid accident investigation by recording additional audio and adding images. While each technology or proposal is intended to improve data recovery and accident investigations, industry has raised various concerns for the commercial fleet regarding the need for such changes and the costs associated with them.

Actions Under Way to Extend Battery Life and Introduce Low Frequency Devices Are Intended to Enhance Flight Recorder Recovery in the Near Term

To help address challenges in locating flight recorders and aircraft wreckage in oceanic areas, FAA and other international aviation authorities have taken actions recommended by the French BEA investigating the AF447 accident to enhance ULBs. Additionally, the NTSB has also recently issued a related recommendation. First, to help address the challenges posed by the limited time that search and rescue authorities have to detect the ULB signal, the BEA recommended extending the ULB battery life from 30 to 90 days. In February 2012, the FAA issued a Technical Standard Order (TSO) for a 90-day battery ULB effective March 1, 2015, at which point the previous TSO for a 30-day battery would be revoked. The FAA issued a TSO authorization to one manufacturer in December 2014 and to another in February 2015. However, on March 10, 2015, the FAA delayed the effective date of the TSO until December 1, 2015, to provide a major aircraft manufacturer additional time for testing and analysis of the device’s installation. Underwater locator beacons manufactured on or after the December 1, 2015, effective date must meet the new requirements. The FAA is not requiring U.S. airlines to retrofit aircraft with a 90-day battery immediately. Instead, airlines are expected to replace 30-day ULB batteries through attrition on their normal replacement schedule of approximately every 6 years so as not to introduce additional costs associated with taking aircraft out of service outside of regular schedules. We estimate that all U.S. domestic aircraft should have a 90-day battery ULB installed by the end of 2021. Related international standards will become effective by 2018.

Second, to help search and rescue authorities locate the aircraft wreckage underwater, the BEA recommended adding a mandatory second underwater locating device with a greater transmission range. The FAA issued a TSO, effective June 26, 2012, that allows manufacturers to add a second optional device directly attached to the airframe. This second device would emit a low-frequency acoustic signal with a range of approximately 5 miles, which is about four times the range of the ULBs attached to the flight recorders. This additional device is optional for airlines and manufacturers. In January 2015, NTSB issued a recommendation for a low-frequency device attached to the airframe that will function for at least 90 days and that can be detected by equipment available on military search and rescue, and salvage assets commonly used to search for and recover wreckage.

Stakeholders we spoke with, including airframe manufacturers, a trade association, and an avionics manufacturer, generally agreed that extending the ULB battery life made sense and could improve flight data recovery for oceanic accidents at a low cost to the airlines; however, there was no consensus on the need for a second underwater locating device. One airframe manufacturer told us that it was taking steps to prepare for attaching a low-frequency device to the airframe, whereas another told us that this might not be necessary if an aircraft tracking solution could meet the same performance of providing an aircraft’s last known location within 6 nautical miles. However, ocean currents can move aircraft wreckage from its initial point of impact, and therefore, it is unclear whether a tracking solution would provide the same function as a second device.

While both the 90-day battery ULB and the low-frequency underwater locating device are intended to help locate the flight recorders and aircraft wreckage in oceanic regions and potentially mitigate some costs with an underwater sonar search, they do not address all the potential challenges of flight recorder retrieval in remote oceanic regions. For example, investigators must still know the general location of impact. Otherwise, the search area would be too large, hampering the location and retrieval of the flight data for the accident investigation despite these longer-life and longer-range devices. The flight tracking proposals discussed previously address this concern to a certain extent. In addition, underwater conditions—including depth, topography, and surrounding conditions—can still affect ULB performance. Range can also be reduced if the device is covered or blocked by aircraft wreckage. Finally, locating the signal is only one step. Even if investigators detect the signal, retrieving the recorders may be difficult if located deep underwater or in difficult terrain.

ICAO and NTSB Have Proposed Flight Data Recovery without Underwater Retrieval, Though Some Stakeholders Identified Concerns for the Commercial Fleet

In addition to enhancing the ULBs to help locate the recorders underwater, governments, international organizations, and industry have been looking at additional changes to improve flight data recovery in oceanic regions, one prescribing a specific technology and another using a performance-based approach. ICAO included automatic deployable flight recorders in its long-term GADSS framework. NTSB issued a safety recommendation calling for a means of recovering flight data without underwater retrieval, which would allow for either a deployable recorder or triggered transmission of mandatory flight data during emergencies. While these technologies are designed to improve flight data recovery, some aviation stakeholders had concerns with installing either of these technologies on the commercial fleet.

Automatic Deployable Flight Recorders

As discussed above, ICAO’s longer-term GADSS framework calls for automatic deployable flight recorders in order to provide faster and easier recovery of flight recorder data, especially in oceanic regions. Deployable recorders, which have been used for decades on U.S. military aircraft, including military versions of commercial aircraft, and helicopters, combine an FDR/CVR with an emergency locator transmitter in one crash-survivable unit. The deployable recorder is designed to separate automatically from an external section of the tail or leading edge of the aircraft when sensors detect an imminent crash. After separation, the deployable recorder is designed to avoid the crash impact zone and, when over oceanic regions, to float indefinitely. These recorders are designed to deploy and emit alert messages even if the aircraft loses power. The embedded emergency locator transmitter would send Cospas-Sarsat satellites an alert every 50 seconds, including the aircraft tail number, country of origin, location of aircraft at separation, and the recorder’s current location.

Several aviation stakeholders—including airframe manufacturers, trade associations, and U.S. domestic airlines—are divided in their support for implementing deployable recorders on the commercial fleet. Boeing and Airbus, for example, have publicly taken different positions. At the NTSB’s forum on flight recorder technology in October 2014, Airbus representatives announced the company’s tentative plans to install deployable recorders on its future A350 and A380 long-haul fleets as a second complementary system to a fixed combination FDR/CVR, though specific timing is unknown. However, at the same forum, Boeing representatives stated that the company had no plans to add deployable recorders to its fleet and that the risk for unintended consequences needed to be studied further.

Deployable recorders would offer several potential benefits, according to stakeholders, including the following:

Faster and easier flight data location and retrieval: Since a properly deployed and undamaged deployable recorder floats indefinitely on the ocean surface and transmits an alert message directly to Cospas-Sarsat for up to 150 hours, it may be easier for searchers to locate and retrieve than a fixed recorder located on the seabed. In the case of AF447, if equipped with a deployable recorder that operated correctly, the device could have alerted searchers to its location, and once found on the ocean’s surface, investigators would have recovered the flight data more quickly than the 2 years it took to locate and retrieve the fixed recorders from the ocean floor. Similarly, if MH370 had a deployable recorder which operated correctly in the event of a crash, investigators would generally know the location at impact and could have recovered the flight data from the ocean’s surface.

Updated location information: The alert messages transmitted from the recorder after deployment could help investigators pinpoint the crash site. Additionally, satellites can track the device’s drift pattern from these messages for up to 150 hours, giving investigators information on ocean currents that may move survivors and debris away from the initial crash site.

No recurring service fees: Data transmission of the emergency locator transmitter signals from a deployable recorder would be free because Cospas-Sarsat has no service fees.

However, some stakeholders highlighted a number of concerns with introducing deployable recorders into the commercial fleet:

Safety: A range of stakeholders that we spoke to, including an airframe manufacturer, avionics manufacturers, and faculty from an academic institution, identified potential safety risks to the aircraft, passengers, maintenance technicians, and others on the ground from inadvertent deployment. According to one manufacturer, even if the industry had met its standard failure rate of less than one incident per 10 million flight hours for civil airborne systems and equipment, there would have been an estimated five incidents involving deployable recorders with the 54.9 million total commercial fleet hours in 2013. These types of incidents could potentially cause damage to both people and property. An airframe manufacturer and an avionics manufacturer told us that the system would need to be designed to ensure the safety of those on the ground and in the air, especially given the infrequency of aviation accidents in which a deployable recorder would be useful.

Infrequency of accidents and success of fixed recorder recovery: One avionics manufacturer and two U.S. domestic airlines that we spoke with questioned the need for deployable recorders given the safety concerns discussed above and the infrequency of aviation accidents. Additionally, when accidents do occur, investigators typically locate and recover the flight data even for accidents occurring over water. Investigators located and recovered the flight recorders in 15 of the 16 commercial accidents, approximately 94 percent of cases that occurred over water since 2000.

Mixed recovery record in military aircraft: According to one stakeholder, flight data recovery rates are actually better on fixed FDRs compared to deployable recorders based on experience with one military aircraft model. For instance, according to industry data of a certain military aircraft that we reviewed from 2004 through 2014, there was a 100 percent flight data recovery for fixed recorders compared to 75 percent with deployable recorders. The causes of those failures included instances in which the recorder did not deploy, was not located, or did not have data on the memory card.

Does not mitigate the need to recover the aircraft wreckage and fuselage, or human remains: While the flight recorders are an important part of the accident investigation, investigators still want to recover the aircraft wreckage and fuselage to help determine the cause of the accident. Therefore, there would still be costs for an underwater search and recovery even if investigators had the deployable recorder.

Hardware costs: Deployable recorders would require adding more equipment on the commercial fleet and, according to the FAA and two avionics manufacturers, would result in additional costs to airlines. The estimated cost is $50,000—$60,000 per unit, according to an avionics manufacturer. We found that the total cost of equipage could be as much as $29 million, and any additional costs associated with certifying each aircraft type model, if this cost per unit were incurred for the current total U.S. long-haul transoceanic fleet. However, for several reasons it is difficult to extrapolate the per-unit cost estimate to obtain a cost estimate for the total fleet. First, costs could vary based on the type of aircraft, the regulatory environment, and other engineering factors, so when widely deployed these factors may affect the costs for varied contexts. Additionally, if a technology becomes mandated or, even if voluntary, becomes widely adopted, unit costs might decline due to the efficiencies of mass production and also possibly due to a greater number of providers entering the market.

Given the safety concerns, costs of equipage, and the uncertain benefits associated with deployable recorders, certain stakeholders, including one airframe manufacturer, one trade association, and one avionics manufacturer, suggested additional study is needed on the use of deployable recorders in commercial aircraft. Additionally, several stakeholders raised concerns about prescribing a specific technology—in this case automatic deployable flight recorders—as opposed to a performance-based approach when implementing or enhancing flight data recovery capabilities, which is the preferred approach of both FAA and the airline industry. Several stakeholders told us that industry needs the flexibility of performance standards over prescriptive solutions due to the diversity of the fleet and to allow for technological advances. FAA officials described their position on deployable recorders as fluid and told us that they did not have plans to mandate a deployable recorder, but also would not prevent an operator from installing one provided the operator adequately demonstrated an acceptable level of safety and performance. In the GADSS framework, ICAO identifies the need to develop performance-based standards for deployable recorders. At the February 2015 Second High-Level Safety Conference, ICAO presented a prescriptive baseline recommendation for deployable recorders and a performance-based alternative, though it is unclear what that alternative would be at this time. At the meeting, member states agreed with a performance-based approach to data retrieval.

Triggered Transmission of Flight Data

In January 2015, NTSB issued a safety recommendation that all new commercial aircraft used in extended overwater operations be equipped with a means of recovering mandatory flight data that does not require underwater retrieval, which builds on earlier efforts from the BEA in response to AF447. While automatic deployable flight recorders as discussed above could meet the recommendation, this performance- based approach also allows for a solution that involves triggering a transmission of mandatory flight data from the aircraft to the ground during emergencies. NTSB’s approach, if adopted by FAA, allows airlines to choose a solution that fits best with their operations. The concept of triggering the transmission of flight data to the ground consists of using flight parameters to detect whether an emergency situation is forthcoming, and if an emergency arises, transmitting data automatically from the aircraft until either the emergency situation ends or the aircraft crashes.

Industry stakeholders cited various potential benefits of triggered transmissions of flight data.

Provides data when physical FDR cannot be recovered: Streaming FDR data allows for post-flight analysis in instances where the physical FDR or its data cannot be easily recovered, including cases where a deployable FDR may not be recovered.

Faster flight data retrieval: Triggered transmission provides required flight data without the need to recover the physical FDR, and therefore, investigators would have data available to them more quickly than if they had to initiate a potentially lengthy search for the physical FDR or deployed FDR. Quicker access to flight recorder data after an incident, especially in oceanic regions, could potentially allow investigators to determine the accident’s cause more quickly. In the case of AF447, if the FDR data were streamed from the aircraft before impact, investigators could have had access to the FDR data more quickly, which would have potentially avoided some of the lengthy search and recovery effort.

Provides location information for aircraft in the event of an accident: In addition to flight data, the transmission of position information could be triggered at a rate that should allow investigators to identify a narrower search area than would otherwise be known through position reports sent at 15-minute intervals. This could minimize the need for emergency locator transmitters, which as discussed previously, several stakeholders told us have been unreliable in providing crash location information.

However, stakeholders we interviewed raised several concerns about implementing data streaming into the commercial fleet.

Bandwidth limitations: Stakeholders—including the FAA, an airframe manufacturer, faculty from an academic institution, a U.S. domestic airline, and two trade associations—told us that while it would likely not be possible to stream FDR data continuously from every aircraft in flight with current satellite capabilities, it could be possible to stream FDR data in a limited number of emergencies. However, a representative from an avionics manufacturer that sells a flight data streaming product told us that streaming voice data was not technically possible at the current time due to limited satellite bandwidth. Therefore, investigators would still need to retrieve the physical CVR to obtain audio information; such retrieval would limit some of the potential benefits of triggered transmission.

Technical challenges: Two avionics manufacturers and an air transport data communications provider also stated that it could be technologically difficult for an aircraft in distress with its satellite antenna not pointing in a fixed position prior to impact to transmit data to satellites. However, there is at least one commercial product— FLYHT’s Automated Flight Information Reporting System—capable of streaming up to all FDR data and position information in near real- time via satellites when triggered by an onboard emergency, and according to this manufacturer, a test flight showed FDR data transmission even when the plane was in an unusual position during flight.

Data privacy and security: Flight recorder data are typically only used for accident investigation purposes. NTSB told us that it was unclear who would control and have access to streamed data and emphasized the importance of validating the data before it becomes public. As such, a few stakeholders raised privacy and security concerns with streaming flight data. The NTSB’s primary concern is having access to flight data to conduct an accident investigation and NTSB officials stated that in the event of an accident in the United States, they should be the first party to download flight recorder information to ensure data integrity.

Does not mitigate the need to recover the aircraft wreckage and fuselage, or human remains: Identical to the concern raised above with deployable recorders, investigators still want to recover the aircraft wreckage and fuselage in order to determine the cause of the accident. Therefore, there would still be some cost for an underwater search and recovery even if investigators had the streamed FDR data.

Equipage and data costs: Stakeholders, including FAA, airframe manufacturers, a trade association, and a U.S. domestic airline, stated that streaming flight recorder data could result in data transmission costs to airlines, especially using satellite communications over oceanic regions, and might require more equipment on aircraft that comes at a cost. The cost of the FLYHT’s Automated Flight Information Reporting System described above is estimated at $70,000 per unit for parts and installation, according to the manufacturer. Assuming that as an average cost, we found that the total cost for the current U.S. long-haul transoceanic fleet could approach $35 million. As noted above, however, extrapolating the current per-unit cost estimate to estimate the cost for the entire fleet has certain limitations. Furthermore, it would cost between $5—$10 per minute for data streaming during emergencies, according to the manufacturer.

The FAA and other stakeholders told us that most aircraft could gather similar data using existing systems, so adding additional equipment to gather and transmit such information may not have an operational benefit for airlines. Representatives from one U.S. domestic airline that we spoke with told us that they did not see the need to equip their fleet with a new device since their system for monitoring aircraft performance could provide engine information through ACARS. Similarly, one airframe manufacturer representative told us that ACARS has helped provide information for accident investigations before FDR recovery. As noted above, ACARS, which is equipped on all new aircraft, can be programmed to transmit some aircraft operations data, including position information, when certain triggers are met.

ICAO and NTSB Have Endorsed Cockpit Recorder Enhancements to Aid Accident Investigations, Though Privacy Issues Are Unresolved

ICAO announced support for extending the duration of the audio captured by the CVR, and NTSB has reiterated its recommendation for installing a cockpit image recorder. According to the NTSB, enhanced cockpit recorders would provide investigators with more information during accident investigations. Despite the potential value of this information to accident investigation, concerns over privacy remain unresolved.

Increasing the Recording Time of the Cockpit Voice Recorder

The ICAO Second High-Level Safety Conference recognized the need to increase CVR recording time to ensure that accident investigators had all relevant flight data. The concern is that CVRs should record and retain audio data for more than 2 hours given the possibility that MH370’s CVR, which was designed to record on a continuous 2-hour loop, recorded over critical events in the plane’s presumed 7-hour flight that could help accident investigators. According to a representative from one avionics manufacturer, 2 hours is insufficient and voice recordings should cover the full duration of the flight like the FDR. Several manufacturers that we spoke with stated that they could make CVRs with additional recording time. One trade association representative told us that the CVR is meant to supplement the information recorded by the FDR and cannot definitively tell investigators what happened by itself and, therefore, cautioned that enhancing subjective audio data may not be necessary if it provides only a marginal improvement.

Installing a Cockpit Image Recorder to Aid Accident Investigation

NTSB, Safety Recommendation, A-00-30 and -31 (Washington, D.C.: Apr. 11, 2000); NTSB, Safety Recommendations, A-15-1 through -8 (Washington, D.C.: Jan. 22, 2015). but they raised concerns that video, similar to audio data, is a subjective and less precise means of information gathering than FDR data. Therefore, they cautioned that video from an image recorder could lead to misinterpretation of the situation. They also cited privacy concerns with video information if improperly disclosed. The NTSB acknowledged the privacy issues with recording images of pilots in its initial recommendation, but also stated that given the history of complex accident investigations and the lack of crucial cockpit environment information, the safety of the flying public must take precedence.

Concluding Observations

In response to the AF447 and MH370 disasters, the international aviation community is considering short- and long-term steps to improve aircraft tracking and flight data recovery with the goal of enhancing accident investigation and aviation safety. Numerous technologies—including communications systems onboard most commercial aircraft today, flight recorders that deploy from aircraft, devices capable of streaming flight recorder data in real time, and global satellite surveillance systems under development—have the potential to enhance aircraft tracking and expedite flight data recovery in the event of an oceanic accident, and industry continues to develop solutions for these tasks. However, some industry stakeholders we spoke with cited concerns about these technologies, such as the cost to equip the fleet and safety implications. Additionally, as AF447 and MH370 make clear, global air traffic control’s preparedness and capability to effectively monitor oceanic flights and provide timely alerts in exceptional situations are important elements in the debate. At the international level, ICAO is finalizing its Global Aeronautical Distress and Safety System based on input from the 2015 High-Level Safety Conference, with formal adoption targeted for 2016. These developments may represent the foundation for a comprehensive, global approach to ensure that the location of an aircraft during all phases of its flight is known to authorities. However, stakeholders expressed concerns that international standards could prescribe adoption of certain solutions, such as deployable recorders. They preferred a performance- based approach that encourages voluntary adoption because of the flexibility such an approach affords industry in an era of rapidly evolving technology. Additionally, the safety record in the National Airspace System may make it difficult to demonstrate that the benefits of new equipage on U.S. airlines outweigh the costs as part of a regulatory analysis. Given the scope of the international processes that are underway, we are not making any recommendations to FAA or NTSB related to aircraft tracking or flight data recovery at this time. Ultimately, we believe it is important for FAA to remain active through the ICAO process to ensure that any new international standard for aircraft tracking and flight data recovery is consistent with a performance-based approach and is implemented in a globally harmonized manner.

Agency Comments

We provided a draft of this report to DOT and NTSB for review and comment. Both DOT and NTSB provided technical comments that we incorporated as appropriate.

As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies of this report to the Secretary of Transportation, the Chairman of the National Transportation Safety Board, and the appropriate congressional committees. In addition, the report will be available at no charge on GAO’s website at http://www.gao.gov.

If you or members of your staff have questions about this report, please contact me at (202) 512-2834 or dillinghamg@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Major contributors to this report are listed in appendix IV.

Appendix I: Organizational Affiliations of Aviation Industry Stakeholders GAO Interviewed

Appendix I: Organizational Affiliations of Aviation Industry Stakeholders GAO Interviewed Federal agencies Federal Aviation Administration International organizations Flight Safety Foundation International Civil Aviation Organization Academic institution Embry-Riddle Aeronautical University FLYHT Aerospace Solutions Ltd.

Appendix II: Proactive Use of Flight Data by Federal Agencies and Industry

This appendix contains information describing how federal agencies and the aviation industry use operational flight data. As we reported in 2010, federal agencies and aviation industry stakeholders gather and analyze aviation data for a variety of purposes. Federal agencies, including the Federal Aviation Administration (FAA) and the National Transportation Safety Board (NTSB), gather and analyze aviation data primarily to improve safety. In addition, as we reported in 2010, the aviation industry gathers quantitative and narrative data on the performance of flights and analyzes these data to increase safety, efficiency, and profitability. Aviation industry stakeholders are required to report some data to FAA— such as data on accidents, engine failures, and near midair collisions— and they have agreements with FAA and other agencies to share other data voluntarily.

For decades, the aviation industry and federal regulators, including FAA, have used data reactively to identify the causes of aviation accidents and incidents. In recent years, FAA has shifted to a more proactive approach to using data to manage aviation safety risk. The FAA continues to use data to analyze past accidents and incidents, and is also using data proactively to search for risks and address potential concerns in the National Airspace System (NAS) before accidents occur or to improve NAS efficiency. According to FAA officials, there is more safety data than ever before, and these data provide the agency with the opportunity to be more proactive about safety. FAA also recognizes that today’s aviation safety, information-sharing environment is not adequate to meet the next generation needs of the NAS. According to FAA, capabilities need to be developed that can continuously extract operationally significant, safety- related information from large and diverse data sources; identify anomalous events or trends; and fuse relevant information from all available sources.

The FAA and the aviation industry have sought additional means for addressing safety problems and identifying potential safety hazards. The FAA has developed a number of programs to encourage the voluntary sharing and industry-wide analysis of operational flight data. In addition to enabling a more proactive approach to addressing safety concerns in the NAS, according to FAA, these programs could potentially enable it to predict the situations under which accidents could occur and take actions to help prevent them before occurring.

Flight Operational Quality Assurance (FOQA): FOQA is a voluntary safety program designed to improve aviation safety through the proactive use of recorded flight data. Operators use these data to identify and correct deficiencies in all areas of flight operations, according to FAA. FAA officials told us that if properly used, FOQA data can reduce or eliminate safety risks, as well as minimize deviations from regulations. Through access to de-identified aggregate FOQA data, FAA can identify and analyze national trends and target resources to reduce operational risks in the NAS, air traffic control, flight operations, and airport operations, according to FAA. The value of FOQA programs, according to FAA, is the early identification of adverse trends, which, if uncorrected, could lead to accidents.

FOQA is a program for the routine collection and analysis of flight data generated during aircraft operations. FOQA programs provide more information about, and greater insight into, the total flight operations environment. FOQA data are unique because they can provide objective information that is not available through other methods, according to FAA. FAA officials told us that a FOQA program can identify operational situations in which there is increased risk, allowing the airline to take early corrective action before that risk results in an incident or accident. For example, according to representatives from one airline, FOQA analysis and findings are incorporated into flight crew training as well as airline policies and procedures. The FOQA program is another tool in the airlines’ overall operational risk assessment and prevention programs. As such, according to the FAA, it must be coordinated with the airlines’ other safety programs, such as the Aviation Safety Action Program and pilot reporting systems, among others.

Aviation Safety Information Analysis and Sharing (ASIAS): FAA and the aviation community have initiated a safety analysis and data sharing collaboration to proactively analyze broad and extensive data to advance aviation safety, according to FAA. The initiative, known as ASIAS, leverages internal FAA data, airline proprietary safety data, publicly available data, manufacturers’ data, and other data. FAA officials told us that the airline safety data are safeguarded by the MITRE Corporation, a federally funded research and development center, in a de-identified manner to foster broad participation and engagement. According to FAA, ASIAS fuses various aviation data sources in order to proactively identify safety trends and assess the impact of changes in the aviation operating environment.

ASIAS resources include both public and non-public aviation data. Public data sources include, but are not limited to, air traffic management data related to procedures, traffic, and weather. Non- public sources include de-identified data from air traffic controllers and aircraft operators, including recorded flight data and safety reports submitted by flight crews and maintenance personnel. According to FAA, governance agreements with participating airlines and owners of specific databases provide ASIAS analysts with access to safety data. Governed by a broad set of agreements, ASIAS has the ability to query millions of flight records and de-identified reports via a secure communications network, according to FAA.

Under the direction of the ASIAS Executive Board, which includes representatives from government and industry, ASIAS conducts studies, safety assessments, risk monitoring, and vulnerability discovery. In the interest of enhancing aviation safety, the results of these analyses are shared with the ASIAS participants, according to FAA. ASIAS has also established key safety benchmarks so that individual airlines may assess their own safety performance against the industry as a whole. According to aviation industry stakeholders we spoke with, the key benefit of participating in this program for the airlines is the opportunity to benchmark their individual performance against the aggregate performance of the industry. Furthermore, according to FAA, ASIAS serves as a central conduit for the exchange of data and analytical capabilities among program participants. The ASIAS vision is a network of at least 50 domestic and international airlines over the next few years, making it the only such center of its kind in the world.

System Safety Management Transformation (SSMT): This FAA effort, which uses ASIAS and other data, seeks to move FAA from a post-hoc, reactive assessment of aviation safety to a more predictive, risk-assessment process. According to FAA, the SSMT project is developing data analysis and modeling capabilities that will enable FAA analysts to both determine how NextGen-related operational improvements will affect safety and evaluate potential risk mitigation strategies. One of the safety analysis methodologies the SSMT team is developing is called the Integrated Safety Assessment Model. The goal of this model is to 1) provide a risk baseline against which to measure future system changes and 2) forecast the risk and safety impacts of implementing changes to the NAS, including FAA’s NextGen initiative. According to FAA, the model has been published, but continues to evolve and efforts are currently under way to refine and update its various components. The model is available as a web- based platform accessible through a user login account. According to FAA, the goal of this work is to describe in a standard format the causes and consequences of aviation accidents since 1996 as well as to describe the precursor events that contributed to these accidents. Using event sequence diagrams, FAA can describe the sequence of events led to an accident. According to FAA, current results indicate positive trends in overall impact as a means to analyze and assess baseline risks as well as emerging risks.

Airlines and airframe manufacturers also use flight data, but primarily to improve the efficiency of operations and increase profitability. As described above, domestic airlines use data collected through FOQA programs to enhance operations and proactively address maintenance issues. Airlines also use data provided through the Aircraft Communications Addressing and Reporting System (ACARS), a communications system that transmits short text messages via radio or satellite, to monitor aircraft and engine performance. According to representatives from one airline we spoke with, these data can show when certain systems and equipment need repair, and help the airline to schedule repairs in order to keep the plane in service. Another airline attributed their very low in-flight engine failure rate, in part, to proactive analysis of airplane health data. Aviation stakeholders said that this type of analysis can help identify the precursors to engine failure and help the airline address problems before the entire aircraft has to be taken out of service.

Finally, airframe manufacturers, such as Airbus and Boeing, have also developed airplane health management programs, which are offered as a service to the airlines. According to Boeing, Airplane Health Management gives airlines the ability to monitor airplane systems and parts and to interactively troubleshoot issues while the plane is in flight. Data collected through these types of programs are captured in flight and transmitted in real time to the airline’s ground operations. Airbus representatives told us that their program is also designed to collect information from various aircraft systems and determine probabilities and likelihood of equipment failure. According to Boeing, airlines can use this service to make maintenance decisions before the plane has landed and be ready for any needed repairs as soon as the airplane arrives at the gate. This information is used by airlines to support operational decisions to “fix-or- fly,” which result in reduced schedule interruptions and increased maintenance and operational efficiency, according to Boeing. Boeing’s Airplane Health Management was first introduced with the 747 and 777 aircraft models, but it has been thoroughly embedded in the design of the 787 model. To support the Airplane Health Management service for the 787, Boeing has a control center where each plane is tracked and its systems are monitored. Similarly, Airbus representatives said their airplane health management program supports the most recent aircraft models.

Appendix III: List of Commercial Aviation Accidents and Recovery over Water from 2000—2015

No. 1

Airbus A320 Karimata Strait, Java Sea (off the coast of Pangkalan Bun, Indonesia)

Malaysia Airlines Flight 370 Boeing B777 Southern Indian Ocean west of Australia (Presumed)

Ethiopian Airlines Flight 409 Boeing B737 Mediterranean Sea (Beirut, Lebanon)

Airbus A310 Moroni, Comoros Islands (off the coast of West Africa)

Airbus A320 New York, USA (Hudson River)

Off the coast of Moorea, French Polynesia Boeing B737 Makassar Strait (off the coast of Sulawesi, Indonesia)

Airbus A320 Black Sea (off the coast of Sochi, Russia)

Off the coast of Palermo, Italy Boeing B747 Taiwan Strait (northeast of Makung, Penghu Islands)

No. 15

Pacific Ocean (north of Anacapa Island, California)

Airbus A310 Abidjan (Off the Ivory Coast, West Africa)

Appendix IV: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contact named above, the following individuals made important contributions to this report: Andrew Von Ah, Assistant Director; Amy Abramowitz; Nabajyoti Barkakati; Jonathan Carver; Leia Dickerson; Chris Falcone; Geoff Hamilton; Bert Japikse; Delwen Jones; Josh Ormond; Madhav Panwar; Justin Reed and Elizabeth Wood.